hvpufaafidelity[.]shop

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Fidelity, a financial services provider. Analysis indicates the site is designed to deceive users into entering credentials by replicating the legitimate Fidelity NetBenefits login portal, as evidenced by the page title 'Log In to Fidelity NetBenefits.' The domain poses a direct risk of credential theft, potentially leading to unauthorized account access and financial fraud. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain hvpufaafidelity.shop was registered on November 24, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent domains. It resolves to the IP address 43.162.126.210, hosted under AS132203 in a data center linked to prior phishing campaigns. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and is flagged by 17 out of 95 security vendors on VirusTotal. Notably, the domain lacks an SSL certificate, further reducing its legitimacy and exposing users to man-in-the-middle attacks. To mitigate risks associated with this brand impersonation threat, users should immediately cease all interaction with hvpufaafidelity.shop. Financial institutions and security teams should update blocklists to include this domain and its associated IP address. Users who may have entered credentials on the site should reset their passwords via the official Fidelity portal and enable multi-factor authentication. Organizations are advised to monitor for unauthorized access attempts and educate users on identifying domain spoofing tactics, such as scrutinizing registration dates and verifying SSL certificates before entering sensitive information.