fidelityxufjpnk[.]cyou

This domain is flagged as an elevated-risk brand impersonation threat targeting Fidelity, specifically mimicking the Fidelity NetBenefits login portal. The fraudulent infrastructure was designed to harvest credentials from users attempting to access legitimate financial services, a tactic commonly associated with credential theft and account takeover schemes. Analysis indicates the domain was operational for a limited period before being taken offline, though its residual risk remains due to the potential for re-deployment or reuse of collected data. Infrastructure analysis reveals the domain fidelityxufjpnk.cyou was registered through Gname.com Pte. Ltd. on November 24, 2025, and resolved to the IP address 43.162.126.210, hosted within the Tencent Building network (AS132203). Security vendors flagged the domain in 17 out of 95 detection engines, a moderate but concerning signal given the absence of an SSL certificate, which is atypical for legitimate financial service portals. The domain appears on one security blocklist and was proactively blocked by PhishDestroy, further corroborating its malicious classification. The page title, 'Log In to Fidelity NetBenefits,' directly mirrors the legitimate Fidelity login portal, increasing the likelihood of successful deception. Mitigation steps for this specific threat type include immediate domain blacklisting across all network security controls, including firewalls, email gateways, and endpoint protection systems. Organizations should implement strict DNS filtering to block resolution of the domain and its associated IP address. Users who may have interacted with the portal should be instructed to reset credentials for any accounts accessed during the exposure window, particularly those tied to financial services. Security teams should monitor for anomalous login attempts or unauthorized transactions linked to Fidelity accounts, as credential harvesting often precedes fraudulent activity. Additionally, verifying the legitimacy of financial service portals through official channels before entering sensitive information remains a critical preventive measure.