fidelityworkplaceil[.]click

Analysis of the domain fidelityworkplaceil.click confirms its classification as a phishing site targeting Fidelity NetBenefits users. The domain was registered on November 30, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent infrastructure. It resolves to the IP address 43.162.112.221, hosted on AS132203 within a Tencent-operated network in the United States. The page title, 'Log In to Fidelity NetBenefits,' directly aligns with the scam type identified as banking phishing, indicating an intent to harvest credentials from financial services users. As of July 24, 2026, the domain has been flagged by 14 of 95 security vendors on VirusTotal, a detection rate consistent with confirmed phishing activity.

It appears on one security blocklist and has been documented in 13 threat intelligence pulses on AlienVault OTX, further corroborating its malicious nature. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment. The domain was actively blocked by PhishDestroy prior to being taken offline, and its SSL certificate (identifier E7) provides no additional trust indicators. Infrastructure analysis reveals no legitimate association with Fidelity Investments or its subsidiaries.

The use of a recently registered domain, combined with hosting on a provider commonly exploited for phishing, aligns with known tactics for credential theft. Defenders should treat this domain as malicious and prioritize blocking it at the network and endpoint levels. Users who may have interacted with the site should be advised to reset credentials for any financial accounts, particularly those linked to Fidelity NetBenefits, and enable multi-factor authentication where available. Further monitoring of related domains registered through Gname.com Pte. Ltd. is recommended to identify potential follow-up campaigns.