fidelityshaeppryv[.]cyou

The domain fidelityshaeppryv.cyou is identified as a phishing site specifically targeting users of Fidelity NetBenefits. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login page mimicking the legitimate Fidelity NetBenefits portal. The page title, 'Log In to Fidelity NetBenefits,' directly aligns with the impersonation of this financial services platform, indicating an intent to deceive users into submitting sensitive credentials. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, a notably elevated detection rate. It was registered through Gname.com Pte. Ltd. on November 19, 2025, and resolved to the IP address 43.162.112.41, hosted under AS132203 in a data center located in the US. The SSL certificate (serial number E8) provides no meaningful trust indicators, as it is not issued by a recognized certificate authority. The domain appears on two security blocklists, including entries from PhishDestroy and PhishingDB, further corroborating its malicious nature. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to its deactivation. Organizations and individuals are advised to block the domain and its associated IP (43.162.112.41) at the network perimeter. Users who entered credentials on this site should immediately reset passwords for Fidelity NetBenefits and enable multi-factor authentication. Security teams should monitor for indicators of compromise, including the domain, IP, and SSL certificate serial number E8, in logs and endpoint telemetry. Proactive threat hunting for related infrastructure, such as domains registered via the same registrar or resolving to the same IP range, is recommended to identify potential secondary campaigns.