fidelitymoawcwf[.]cyou

This domain is flagged as a high-confidence credential-harvesting phishing site targeting users of Fidelity NetBenefits, a financial benefits management platform. Analysis indicates the infrastructure is designed to deceive victims into submitting login credentials, which are then exfiltrated to attacker-controlled servers. The threat type is classified as generic_phishing with an elevated risk level due to its direct targeting of financial accounts and verified malicious activity. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain fidelitymoawcwf.cyou was registered on February 21, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. It resolves to IP address 43.162.126.210, hosted on AS132203 within a Tencent data center in the United States. The SSL certificate (identifier E7) provides no meaningful trust validation, a common trait in phishing operations. Security vendors on VirusTotal flagged the domain at a rate of 17/95, while it appears on two independent blocklists: PhishDestroy and PhishingDB. The page title, Log In to Fidelity NetBenefits, precisely matches the legitimate Fidelity portal, increasing the likelihood of successful social engineering. Mitigation requires immediate action from both end users and network defenders. Users who accessed this domain should assume credential compromise and initiate password resets for all associated accounts, particularly financial or benefits-related services. Multi-factor authentication should be enabled where available to prevent unauthorized access. Network administrators are advised to block the domain and IP address 43.162.126.210 at the perimeter, and monitor for connections to this infrastructure from internal hosts. Security teams should review logs for any prior interactions with the domain, particularly POST requests to login endpoints, which may indicate credential submission. Given the domain's current offline status, defenders should remain vigilant for re-emergence under similar naming conventions or infrastructure patterns.