fidelitysafetycv[.]one

The domain fidelitysafetycv.one is identified as a high-risk phishing site targeting users of Fidelity NetBenefits. Analysis confirms it is designed to harvest login credentials by mimicking the legitimate Fidelity financial platform. The domain is currently offline, but prior activity indicates malicious intent. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 43.162.115.222, hosted on AS132203 in the United States. The SSL certificate is issued by Let's Encrypt (serial number E7). Security vendors on VirusTotal flagged the domain as malicious, with 22 of 95 engines detecting it as phishing. It appears on one security blocklist and is explicitly blocked by PhishDestroy, with Google Safe Browsing also classifying it as a phishing threat. At present, fidelitysafetycv.one has been taken offline, reducing immediate risk. However, users who accessed the domain prior to its deactivation should assume credential exposure and take corrective action. Recommended steps include resetting passwords for Fidelity accounts, enabling multi-factor authentication, and monitoring financial statements for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address (43.162.115.222) to prevent future access attempts.