fidelityadvice[.]click

Analysis indicates that the domain fidelityadvice.click was registered on 21 February 2026 and is presently taken offline. The site presented a page titled “Log In to Fidelity NetBenefits”, indicating a banking‑phishing lure aimed at Fidelity NetBenefits users. The domain resolves to IP 43.162.112.232, which is hosted in the United States and assigned to ASN 132203, a Tencent‑owned network located on Kejizhongyi Avenue. The TLS certificate is identified as “E7”, suggesting a low‑grade or self‑signed certificate, which is typical for malicious infrastructure.

The domain has been flagged by PhishDestroy and appears on one public blocklist. AlienVault OTX records show the domain in three separate threat‑intel pulses, reinforcing its association with phishing campaigns. VirusTotal scans returned 11 positive detections out of 93 vendors, confirming that a notable fraction of security products recognize the site as malicious. The overall risk rating is elevated, and the combination of recent registration, targeted page title, low‑trust SSL, and multi‑vendor detections suggests an active credential‑harvesting operation.

Because the site is currently offline, defenders should still enforce proactive controls: add the domain and its resolving IP to network‑level blocklists, monitor DNS queries for the domain, and incorporate the indicator set into email‑gateway and web‑proxy filtering rules. Continuous observation of the IP address for potential reuse is advised, as threat actors often repurpose compromised hosting. The limited publicly available evidence prevents assessment of the full payload or post‑login behavior, so additional sandbox or sinkhole analysis would be required if the site reappears.