fidelityportfolloknowledge[.]lat

This domain, fidelityportfolloknowledge.lat, is flagged as a credential phishing site impersonating Fidelity, a financial services brand. Analysis indicates the site was designed to harvest login credentials under the pretext of accessing Fidelity NetBenefits, as evidenced by the page title "Log In to Fidelity NetBenefits." No drainer kit signatures were identified in initial scans, though further forensic analysis of the offline infrastructure may reveal additional payload delivery mechanisms.

Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on November 29, 2025, and resolves to the IP address 43.162.112.221, hosted within AS132203 (Tencent Building, Kejizhongyi Avenue, US). The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of transmitted data. VirusTotal reports 19 out of 95 security vendors detecting the domain as malicious. The domain appears on two security blocklists and is currently not listed in Google Safe Browsing. No associated subdomains or redirect chains were observed in passive DNS records.

As of the latest verification, fidelityportfolloknowledge.lat has been taken offline, likely due to takedown actions by hosting providers or domain registrars. The domain is blocked by PhishDestroy and PhishingDB, reducing immediate exposure to end users. However, residual risk persists due to the potential reuse of the infrastructure or registration of similar domains by the same threat actor. Organizations are advised to monitor for newly registered domains containing "fidelity" or "netbenefits" keywords, implement network-level blocking of the observed IP (43.162.112.221), and educate users on recognizing brand impersonation tactics in phishing campaigns. Forensic artifacts, including the domain registration details and IP history, should be preserved for potential attribution or legal proceedings.