fldeiltyportfolioknowiedge[.]lat

This domain, fldeiltyportfolioknowiedge.lat, is a credential theft operation targeting users of Fidelity Investments' NetBenefits platform. Analysis of the page title, 'Log In to Fidelity NetBenefits,' confirms the domain is designed to harvest login credentials by impersonating the legitimate financial services portal. The infrastructure mimics trusted authentication flows to deceive victims into submitting sensitive account details, which could lead to unauthorized access, fund transfers, or identity fraud targeting retirement and investment accounts. Technical indicators reveal multiple red flags: the domain is flagged by 14 out of 95 security vendors on VirusTotal, appears on two distinct security blocklists, and is blocked by specialized anti-phishing systems. Registered on February 21, 2026, the domain resolves to IP address 43.162.112.221, hosted under AS132203 in a data center facility linked to prior malicious activity. The SSL certificate, issued under serial number E8, lacks the extended validation typical of legitimate financial institutions, further indicating fraudulent intent. Users who visited this domain or entered credentials should immediately revoke active sessions on all Fidelity accounts and enable multi-factor authentication if not already active. Monitor account statements for unauthorized transactions and report suspicious activity to the financial institution. Reset passwords for any accounts where identical credentials were reused, as harvested data may be exploited across multiple platforms. Organizations should update blocklists to include this domain and its associated IP to prevent further exposure.