fidelitysecurity[.]cv

This domain, fidelitysecurity.cv, is flagged as an elevated-risk credential harvesting phishing site specifically impersonating Fidelity's NetBenefits login portal. The threat type involves direct brand impersonation to capture sensitive financial credentials, including usernames, passwords, and potentially multi-factor authentication tokens. Analysis indicates a targeted attack against Fidelity customers, leveraging a near-identical replica of the legitimate login interface to deceive victims into disclosing confidential account access details. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on November 24, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to IP address 43.162.126.210, hosted on AS132203 within a Tencent-operated data center in the United States, an unusual infrastructure choice for a financial services impersonation. The domain lacks any SSL certificate, exposing all transmitted data in plaintext. VirusTotal detection metrics show 19 out of 95 security vendors flagging the domain as malicious, with one confirmed entry on a security blocklist. The page title, 'Log In to Fidelity NetBenefits,' precisely matches the legitimate portal, indicating a high-fidelity impersonation designed to evade user suspicion. Mitigation requires immediate action from both organizational and individual stakeholders. Network administrators should implement DNS-based blocking for fidelitysecurity.cv and its resolving IP address 43.162.126.210 at the perimeter level. Security teams should deploy indicators of compromise (IOCs) into endpoint detection systems, including the domain, IP, and associated registrar details. Fidelity customers should be alerted to verify all login portals via official channels, avoiding direct links from emails or third-party sites. Multi-factor authentication should be enforced for all financial accounts, and users should be trained to inspect URL structures, SSL certificates, and registrar information before entering credentials. Given the domain's current offline status, monitoring for re-registration or similar impersonation domains using the same infrastructure patterns is recommended.