fldeiltytextservicea[.]world

PhishDestroy has identified fldeiltytextservicea.world as an elevated-risk phishing domain that specifically impersonates Fidelity, a well-known financial services brand. The domain was designed to trick users into believing they are logging into the legitimate Fidelity NetBenefits portal, as evidenced by its page title, 'Log In to Fidelity NetBenefits'. This type of brand impersonation attack is highly dangerous because it preys on user trust and can lead to the theft of sensitive financial credentials.

The domain was registered on November 28, 2025, through Gname.com Pte. Ltd., and resolves to the IP address 43.162.112.221. It does not have an SSL certificate, which is a major red flag for any site handling login credentials. VirusTotal flagged the domain with 19 out of 95 security vendors marking it as malicious, and it appears on two security blocklists. Additionally, AlienVault OTX recorded its presence in 16 threat intelligence pulses, indicating widespread recognition of its malicious nature. Despite being taken offline, the domain's brief activity was sufficient to pose a significant risk to users.

Users who may have encountered this domain should immediately change their Fidelity NetBenefits password and enable two-factor authentication if available. It is also advisable to monitor financial accounts for any unauthorized activity and report any suspicious transactions to Fidelity. PhishDestroy recommends avoiding clicking on links in unsolicited emails or messages, and always verifying the URL before entering login credentials. For any concerns, users should contact Fidelity directly through official channels.