fideitytextservice[.]world

fideitytextservice.world is a domain associated with a credential theft attack, specifically impersonating Fidelity NetBenefits. The domain is designed to trick users into providing their login credentials by mimicking the legitimate Fidelity NetBenefits login page. Analysis indicates a potential threat to users who may be redirected or deceived into accessing this site.

Technical indicators for fideitytextservice.world include a VirusTotal score of 17/95, indicating a significant proportion of security vendors identify this domain as malicious. The domain is registered through GNAME.COM PTE. LTD., and it was created on November 26, 2025. The domain resolves to the IP address 43.162.126.210, located in the United States under the Autonomous System AS132203, which is associated with Tencent Building, Kejizhongyi Avenue. The site is blocked by PhishDestroy and appears on 1 security blocklist. These indicators suggest a well-coordinated and targeted phishing campaign.

As of the latest assessment, the domain is offline, which reduces the immediate risk to potential victims. However, the creation of such a domain and its brief active period indicate that the threat actors may have collected sensitive information before it was taken down. Organizations should advise their users to change passwords and monitor for any unauthorized access. The offline status does not eliminate the need for ongoing vigilance, as the domain may be reactivated or similar tactics employed by threat actors in the future.