fldelltyportfolloknowiedge[.]lat

Analysis of fldelltyportfolloknowiedge.lat shows a domain that has been actively used for a banking phishing campaign targeting Fidelity NetBenefits users. The site presents the page title “Log In to Fidelity NetBenefits,” a clear indicator of credential‑harvesting intent. The domain was registered on November 29, 2025 through Gname.com Pte. Ltd., and it resolves to the IP address 43.162.112.221, which is mapped to the AS132203 Tencent Building in China but is listed as located in the United States. The hosting infrastructure carries an SSL certificate rated E7 and receives a Gridinsoft trust score of 0 out of 100, both suggesting a lack of legitimate security posture.

Threat intelligence sources confirm the domain’s malicious nature: it appears on one security blocklist, is blocked by PhishDestroy, and has been cited in fourteen AlienVault OTX pulses. VirusTotal scans report fourteen of ninety‑three security vendors flagging the domain, reinforcing the assessment of risk. The current HTTP status is offline, indicating that the phishing site has been taken down, but the underlying infrastructure remains observable and could be re‑activated.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address for any future activity, and incorporate the domain into threat‑intel feeds. Given the low trust scores, weak SSL rating, and multiple vendor detections, the domain should be treated as high‑confidence phishing and eradicated from any allow‑list. Continued vigilance is advised, especially for users of Fidelity NetBenefits, to prevent credential compromise should the site be resurrected.