fidelitysafetyc[.]one

This domain, fidelitysafetyc.one, operates as a phishing site designed to mimic the legitimate Fidelity NetBenefits login portal. The site targets users attempting to access their financial or retirement accounts by presenting a fraudulent login interface that captures entered credentials. Once submitted, these credentials are transmitted to threat actors, who may use them for unauthorized account access, financial fraud, or identity theft. The page title, 'Log In to Fidelity NetBenefits,' is identical to the legitimate service, increasing the likelihood of deception for unsuspecting users. Analysis indicates this domain is part of a credential harvesting campaign. The domain was registered on January 23, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious infrastructure. It resolves to the IP address 43.162.115.222, hosted on an autonomous system linked to prior phishing activity. Security vendors on VirusTotal flagged the domain, with 17 out of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate (identifier E7) lacks legitimate validation, further confirming its fraudulent nature. If you visited fidelitysafetyc.one or entered login credentials on the site, immediate action is required. First, change the password for your Fidelity account and any other platforms where the same credentials were reused. Enable multi-factor authentication on all financial accounts to add an additional layer of security. Monitor your accounts for unauthorized transactions or suspicious activity, and report any anomalies to the legitimate service provider. If financial data was exposed, consider placing a fraud alert or credit freeze with major credit bureaus. Finally, scan your device for malware to ensure no additional compromise occurred during the interaction.