fidelitygbsmckx[.]shop

This domain, fidelitygbsmckx.shop, is flagged as a brand impersonation phishing site designed to deceive users into believing they are accessing legitimate Fidelity financial services. The page title, 'Log In to Fidelity NetBenefits,' mimics the authentic login portal, increasing the likelihood of credential theft or unauthorized account access. Analysis indicates the domain specifically targets individuals attempting to manage retirement accounts, benefits, or investments through Fidelity’s platform, exploiting trust in the brand to harvest sensitive financial information. Infrastructure analysis reveals the domain was registered on November 24, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious or high-risk domains. It resolves to the IP address 43.162.126.210, located in the US under AS132203 (Tencent Building, Kejizhongyi Avenue), an autonomous system with a history of hosting phishing infrastructure. The domain appears on 2 security blocklists, including PhishDestroy and PhishingDB, and is flagged by 18 out of 95 security vendors on VirusTotal. Notably, the site lacks an SSL certificate, a red flag for users expecting encrypted connections on financial platforms. Users who visited fidelitygbsmckx.shop or entered credentials on the site should immediately revoke any active sessions on their legitimate Fidelity accounts and change their passwords using a secure, verified connection. Enable multi-factor authentication (MFA) if not already active, and monitor account statements for unauthorized transactions. If financial data or personally identifiable information (PII) was submitted, consider placing a fraud alert or credit freeze with major credit bureaus. Network administrators should block the domain and its resolving IP (43.162.126.210) at the perimeter to prevent further access. Report the incident to the targeted brand’s security team for further investigation and takedown coordination.