fldeiitytextservlce[.]world

This domain, fldeiitytextservlce.world, operates as a credential theft platform specifically targeting users of Fidelity NetBenefits. Analysis of the page title, 'Log In to Fidelity NetBenefits,' confirms the domain mimics legitimate financial services login portals to harvest account credentials. The infrastructure is designed to deceive users into entering sensitive authentication details, which are then exfiltrated to attacker-controlled servers for unauthorized account access or financial fraud. The targeted nature of this campaign suggests a focus on high-value financial accounts, increasing the potential impact on victims. Evidence supporting the malicious classification includes detection by 17 of 95 security vendors on VirusTotal, alongside presence on two independent security blocklists. The domain was registered on November 26, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. It resolves to the IP address 43.162.126.210, hosted within AS132203 (Tencent Building, Kejizhongyi Avenue), an autonomous system previously linked to other phishing operations. The SSL certificate, identified as E8, lacks organizational validation, further indicating its use in fraudulent activities. The rapid takedown of this domain suggests either intervention by hosting providers or abandonment by threat actors following exposure. Users who visited fldeiitytextservlce.world or entered credentials on the site should immediately revoke any submitted login details through their official Fidelity account recovery process. Enable multi-factor authentication on all financial accounts to mitigate unauthorized access risks. Monitor account statements for unauthorized transactions and report suspicious activity to the legitimate service provider. If personal or financial data was disclosed, consider placing a fraud alert with credit bureaus to prevent identity theft. Security teams should block the domain, IP address 43.162.126.210, and associated SSL certificate E8 across network defenses to prevent further exposure.