fldelltytextservicea[.]world

This domain, fldelltytextservicea.world, operates as a credential harvesting site targeting users of Fidelity NetBenefits, a financial services platform. The phishing page mimics the legitimate login interface, presenting a page titled 'Log In to Fidelity NetBenefits' to deceive victims into entering sensitive authentication details. Such infrastructure is commonly used to capture usernames, passwords, and other personally identifiable information (PII), which may be exploited for unauthorized account access, financial fraud, or identity theft. The targeting of financial services users elevates the risk, as compromised credentials can lead to direct monetary loss or further compromise of linked accounts. Analysis of the domain reveals multiple technical indicators confirming its malicious nature. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection as phishing infrastructure. It was registered on November 28, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with abusive domains. The domain resolves to the IP address 43.162.112.221, hosted on AS132203 in a data center located in the US, despite the IP geolocation suggesting a non-US origin. No SSL certificate is present, increasing the likelihood of interception or further exploitation. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline, though this does not preclude future reactivation. Users who visited fldelltytextservicea.world or entered credentials on the site should take immediate action to mitigate risk. All entered credentials must be considered compromised and should be changed immediately on the legitimate Fidelity NetBenefits platform and any other services where the same credentials were reused. Affected individuals should enable multi-factor authentication (MFA) on all financial and sensitive accounts to prevent unauthorized access. Monitoring for unusual account activity, such as unauthorized transactions or login attempts, is strongly advised. If financial data was exposed, users should contact their financial institution to report potential fraud and request account monitoring or freezing. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future access by employees or customers.