evkgoeyfidelity[.]cyou

The domain evkgoeyfidelity.cyou was registered on 24 November 2025 through Gname.com Pte. Ltd. and is currently listed as offline. It is explicitly associated with a banking phishing campaign that targets Fidelity customers, as indicated by the page title "Log In to Fidelity NetBenefits" and the declared brand target of Fidelity. Infrastructure analysis shows the domain resolves to IP address 43.162.126.210, which is geolocated to the United States and resides within AS132203, a Tencent‑owned network on Kejizhongyi Avenue. The authoritative name servers are a.share-dns.com, a9.share-dns.com, b.share-dns.net, and b9.share-dns.net, a configuration commonly observed in fast‑flux or disposable hosting services.

No SSL certificate is presented for the site, meaning traffic would be unencrypted and susceptible to interception. Reputation services provide converging signals of high risk: Gridinsoft assigns a trust score of 0 out of 100, Scamadviser rates the domain 1 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis reports that 15 of 95 scanned security vendors flag the domain as malicious, reinforcing the suspicion of phishing activity. The domain is already blocked by PhishDestroy, indicating that at least one dedicated anti‑phishing service has taken mitigation action.

While the site is offline, the observed infrastructure—public IP, shared DNS, lack of TLS, and low trust scores—suggests it was intended to host a credential‑harvesting page. Defenders should continue to monitor the domain and associated IP address for any re‑activation, enforce URL filtering policies that block the domain and its IP, and consider adding the domain to internal blocklists. Additionally, security teams should alert users of Fidelity and related financial services about the attempted impersonation, advising them to verify URLs and avoid entering credentials on untrusted sites.