mtennbtfidelity[.]shop

This domain, mtennbtfidelity.shop, is a confirmed phishing site targeting users of Fidelity NetBenefits, as indicated by its page title 'Log In to Fidelity NetBenefits' and classification as a banking phishing scam. Registered on November 24, 2025, through Gname.com Pte. Ltd., the domain resolved to IP address 43.162.126.210, hosted on AS132203 (Tencent Building, Kejizhongyi Avenue) with a geolocation listed as the US. The infrastructure analysis reveals the use of nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET, which are often associated with low-reputation hosting environments. The SSL certificate, graded E8, suggests poor encryption standards, further indicating malicious intent. Detection data from multiple sources supports the phishing classification.

The domain appears on one security blocklist and is flagged by 16 of 93 security vendors in VirusTotal, though the specific detection rules are not detailed in the available intelligence. AlienVault OTX lists the domain in 12 threat intelligence pulses, reinforcing its association with known malicious activity. The site was actively blocked by PhishDestroy and is currently offline, though defenders should treat its infrastructure as compromised. Defenders are advised to review logs for connections to 43.162.126.210 and the domain itself, particularly in contexts involving financial or employee benefits portals.

The registration details and hosting provider should be considered high-risk for future phishing campaigns. While the exact content of the phishing kit is not analysed, the page title confirms the targeted brand. No evidence of redirection chains or additional payloads is present in the available data. Given the domain's recent creation and rapid detection by security vendors, it is likely part of a broader campaign leveraging similar infrastructure.