fldelityportfolioknowiedge[.]lat

This domain is flagged as an elevated-risk credential theft operation targeting Fidelity NetBenefits users. Analysis indicates the infrastructure was established to harvest login credentials through brand impersonation, presenting a fake login portal with the page title 'Log In to Fidelity NetBenefits.' The domain poses a direct threat to financial account security and user authentication data. Infrastructure analysis reveals the following indicators: the domain fldelityportfolioknowiedge.lat was registered on November 30, 2025, through Gname.com Pte. Ltd. It resolves to IP address 43.162.112.221, hosted on AS132203 in the United States. The SSL certificate is graded E8, indicating poor security practices. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by 17 out of 95 security vendors on VirusTotal. The creation date suggests a recent, purpose-built malicious campaign rather than a compromised legitimate site. Mitigation steps specific to credential theft include immediate blocking of the domain and its associated IP (43.162.112.221) at network perimeter controls. Organizations should deploy email filtering rules to quarantine messages containing the domain or its variations. End users should be alerted to verify the authenticity of any Fidelity-related login prompts, particularly those received via unsolicited emails or messages. Multi-factor authentication should be enforced for all financial accounts to reduce the impact of stolen credentials. Security teams are advised to monitor for authentication attempts from the identified IP address and investigate any anomalous login activity linked to Fidelity NetBenefits.