fidelityworkplaceeg[.]click

On July 25, 2026, the domain fidelityworkplaceeg.click was observed hosting a page titled “Log In to Fidelity NetBenefits”. The page title directly references Fidelity’s NetBenefits portal, indicating a banking phishing campaign aimed at credential harvesting. The domain was registered on 21 February 2026 and is currently taken offline, with the takedown attributed to the PhishDestroy mitigation service. DNS resolution points to the IPv4 address 43.162.112.221, an address located in the United States and associated with AS132203 (Tencent Building, Kejizhongyi Avenue). The host carries an SSL certificate identified only as “E7”, providing no meaningful validation of the site’s authenticity.

Reputation scoring from Gridinsoft assigns a zero‑out‑of‑one‑hundred trust rating, reflecting extreme suspicion. AlienVault OTX lists the domain in fourteen separate threat‑intel pulses, reinforcing its classification as malicious. VirusTotal analysis shows that seventeen of ninety‑three scanning engines flagged the domain, further corroborating its hostile nature. The domain appears on a single security blocklist and has not been observed in other public safebrowsing feeds.

Because the site is offline, direct content inspection is not possible, leaving the exact payload and credential‑capture mechanisms unverified. However, the convergence of a targeted page title, low trust score, multiple OTX mentions, and vendor detections strongly suggests a credential‑stealing operation targeting Fidelity NetBenefits users. Defenders should continue to block the domain at perimeter filters, monitor for DNS queries to 43.162.112.221, and enforce multi‑factor authentication for any Fidelity account access. Incident response teams should also review recent authentication logs for signs of attempted logins using harvested credentials and consider informing affected users of the phishing attempt.