fidelitysafetyac[.]one

This domain, fidelitysafetyac.one, is identified as a credential theft operation specifically targeting users of Fidelity NetBenefits. Analysis indicates the site mimics the legitimate Fidelity login portal, as evidenced by the page title Log In to Fidelity NetBenefits, to harvest user credentials. No direct evidence of a crypto drainer kit or payment skimming infrastructure was observed, but the focus on credential capture aligns with typical pre-fraud activity in financial account takeovers. The domain exhibits multiple high-risk characteristics consistent with organized phishing campaigns. Infrastructure analysis reveals critical technical indicators: the domain was registered on February 21, 2026, an anomalous future date suggesting potential registrar manipulation or data obfuscation. It resolves to the IP address 43.162.115.222, hosted on AS132203 within a data center associated with high-risk hosting providers. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate, identified as E7, lacks transparency and may be part of a low-cost or automated certificate issuance process commonly exploited by threat actors. As of the latest assessment, fidelitysafetyac.one has been taken offline, likely in response to detection and reporting. However, the domain registration remains active, posing a residual risk of reactivation or migration to a new host. Users who accessed the site prior to takedown should assume credential exposure and initiate immediate password resets on all linked financial accounts. Organizations are advised to monitor network logs for connections to 43.162.115.222 and implement domain-based blocking for fidelitysafetyac.one and related typosquatting variants. The elevated risk level persists due to the domain's recent creation, brand impersonation, and prior malicious hosting history.