fidelitysafetyes[.]one

The domain fidelitysafetyes.one was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently taken offline. DNS resolution points to the IPv4 address 43.162.115.222, which belongs to AS132203 and is geolocated in the United States at the Tencent Building on Kejizhongyi Avenue. The domain is served by the authoritative name servers a.share-dns.com, a4.share-dns.com, b.share-dns.net, and b4.share-dns.net. No TLS certificate is presented for the site, indicating that any HTTP traffic would be unencrypted.

The page title returned by the web server is "Log In to Fidelity NetBenefits," and the domain is explicitly tagged as impersonating the Fidelity brand in a banking phishing campaign. Security telemetry shows a Gridinsoft trust score of 0 out of 100, and the domain is listed on one security blocklist. It has been blocked by the PhishDestroy filtering service and flagged by Google Safe Browsing for social engineering. AlienVault OTX reports the domain in a single threat intelligence pulse, and VirusTotal analysis shows that 21 of 93 scanned security vendors flagged the domain as malicious.

The evidence collectively indicates a high‑confidence, high‑risk brand impersonation attempt targeting Fidelity customers. Defenders should ensure that outbound traffic to 43.162.115.222 is denied or closely monitored, enforce strict URL filtering to block fidelitysafetyes.one, and update internal phishing detection rules to include the observed page title and the identified name server set. Continuous monitoring of the registrar Gname.com for any new domains using similar naming patterns is advised, as is reviewing any authentication logs for attempts to access URLs matching the "Log In to Fidelity NetBenefits" title. Because the site is offline, threat actors may reactivate it; therefore, threat‑intel feeds should be refreshed regularly to capture any re‑registration or changes in hosting infrastructure.