fidelitysummary[.]vip

This domain, fidelitysummary.vip, is identified as a credential phishing site specifically targeting users of Fidelity NetBenefits. Analysis indicates the site replicates the legitimate login interface of Fidelity Investments, a financial services provider, to harvest sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. No specific drainer kit or post-exploitation framework has been conclusively linked to this domain at this time, though the infrastructure aligns with common phishing-as-a-service (PhaaS) patterns observed in recent campaigns. Infrastructure analysis reveals multiple technical indicators of compromise. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating broad detection across the security community. It was registered through Gname.com Pte. Ltd. on November 13, 2025, and resolves to the IP address 43.162.109.164, hosted on autonomous system AS132203 within a data center in the United States. The domain appears on one security blocklist and is currently not listed on Google Safe Browsing. The SSL certificate, identified by the serial number E8, was issued by a non-standard certificate authority, further suggesting malicious intent. As of the latest assessment, fidelitysummary.vip has been taken offline, reducing immediate exposure to end users. However, residual risk remains due to potential credential reuse by victims who may have interacted with the site prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts using credentials associated with Fidelity accounts. Users who entered login details on this domain should immediately reset their passwords, enable multi-factor authentication, and review account activity for anomalies. The domain's registration date and hosting infrastructure suggest it may be part of a larger, coordinated phishing operation, warranting continued vigilance against similar threats.