fidelity[.]ihsbonline[.]com

The domain fidelity.ihsbonline.com was observed hosting a fraudulent site that presents the page title “Fidelity IHS - Money Transfer & Online Banking”. The site is classified as a banking phishing campaign that attempts to impersonate the Fidelity brand, as indicated by the page title and the “Brand target: across” entry. The domain was registered through NameCheap, Inc. on 1 October 2024 and resolves to the IP address 135.125.140.191, which belongs to the OVH SAS network (AS16276) located in Germany. No TLS certificate is deployed, meaning traffic is served over plain HTTP. The infrastructure uses three custom nameservers—ns1.cloudoon.com, ns2.cloudoon.net, and ns3.cloudoon.org—suggesting a self‑managed hosting environment.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans show that two out of ninety‑five scanners flagged the domain, reinforcing the malicious assessment. A Gridinsoft trust score of 0 / 100 further indicates a lack of legitimacy. The site’s current status is listed as offline, which may be the result of takedown actions or automated sinkholing. Evidence gaps remain: the exact content of the landing page has not been captured, so the presence of credential‑capture forms or redirects cannot be confirmed.

Additionally, no public Safe Browsing or OTX entries were referenced in the provided data, limiting insight into broader detection coverage. Defenders should continue to monitor the IP 135.125.140.191 and associated nameservers for any re‑use, enforce outbound filtering for the domain and related hostnames, and ensure that users are warned about unsolicited communications that reference Fidelity services. Blocking the domain at the DNS level and adding the IP to threat‑intel feeds will help prevent future exposure. Ongoing collaboration with registrars and hosting providers is recommended to accelerate takedown of any revived infrastructure.