fidelitysafetyer[.]one

This domain, fidelitysafetyer.one, is assessed as a high-risk phishing site specializing in brand impersonation. Analysis indicates the threat actor designed the site to mimic Fidelity’s legitimate login portal, specifically replicating the "Log In to Fidelity NetBenefits" page title. The objective appears to be credential harvesting, likely targeting financial account access or sensitive personal information under the guise of a trusted financial services provider. No evidence of crypto-drainer functionality was observed, but the site’s design and targeting align with classic account takeover tactics. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. It resolves to the IP address 43.162.115.222, hosted within AS132203 (Tencent Building, Kejizhongyi Avenue), an autonomous system previously linked to phishing and fraudulent activities. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal detection metrics further corroborate the malicious classification, with 21 out of 95 security vendors marking the domain as malicious. Notably, the site lacks an SSL certificate, a deviation from legitimate financial platforms that universally enforce HTTPS. Mitigation measures should prioritize blocking access to the domain and its associated IP address across network security controls. Organizations are advised to implement real-time phishing detection mechanisms to identify and neutralize similar brand impersonation attempts. End users should be educated on recognizing phishing indicators, such as mismatched URLs, missing SSL certificates, and suspicious domain registration details. Financial institutions and their customers are urged to enable multi-factor authentication (MFA) to mitigate the impact of credential theft. Given the domain’s current offline status, continuous monitoring for re-emergence or related infrastructure is recommended, as threat actors often re-deploy phishing assets under new domains or IPs.