fidel-ityreukl[.]shop

On July 23, 2026 investigators documented the domain fidel-ityreukl.shop, which is currently offline. The domain was created on November 15, 2025 via the registrar Gname.com Pte. Ltd. and uses the authoritative nameservers a.share-dns.com and b.share-dns.net. DNS resolution points to IP address 198.18.0.63, which does not present an SSL/TLS certificate, indicating an unencrypted HTTP service. The page title captured during a brief crawl reads “Log In to Fidelity NetBenefits,” aligning with the classified scam type of banking phishing targeting Fidelity NetBenefits users. VirusTotal recorded 13 detections out of 95 security vendors, providing vendor‑level confirmation of malicious intent.

AlienVault OTX references the domain in 16 threat‑intelligence pulses, and PhishDestroy has listed it as blocked. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one additional security blocklist, reinforcing its elevated risk rating. The unique seed 6e0f05 links this observation to related samples in internal repositories, aiding correlation with prior incidents that employed similar phishing kits. Uncertainties remain regarding the underlying hosting provider, ASN, or any additional payload details because the site is offline and no further content analysis is available.

Defenders should continue to block all traffic to 198.18.0.63, add fidel-ityreukl.shop to URL filtering and email‑gateway deny lists, and search recent email logs for the “Log In to Fidelity NetBenefits” title or references to the domain. Incident response teams should quarantine any messages containing the domain and monitor for residual cached copies. Updating threat‑intel feeds with the observed OTX pulse count and the 13‑vendor detection signature will improve automated detection. Ongoing observation of registrations through Gname.com Pte. Ltd. and the share‑dns nameservers may reveal future campaigns employing comparable infrastructure.