fidelityworkplacemc[.]click

Analysis of fidelityworkplacemc.click shows a confirmed banking phishing infrastructure targeting Fidelity NetBenefits users. The site was registered on February 21, 2026 and currently resolves to IP address 43.162.124.172, which is associated with a Tencent‑owned hosting facility in the United States (AS132203). The page title "Log In to Fidelity NetBenefits" aligns with the reported scam type of banking phishing, indicating an attempt to harvest credential data for the Fidelity brand. The domain appears on one external security blocklist and is actively blocked by PhishDestroy, demonstrating that it has already been identified and mitigated by at least one commercial mitigation service.

VirusTotal scans have recorded 12 positive detections out of 95 security vendors, reinforcing the malicious classification. AlienVault OTX lists the domain in 14 separate threat‑intel pulses, providing additional community corroboration of its malicious use. The SSL certificate is rated E7, suggesting a weak or mis‑issued certificate that further diminishes trust. Gridinsoft assigns a trust score of 0/100, indicating the highest level of suspicion.

Although the site is presently offline, the underlying IP and hosting environment remain active, and the indicators may be reused for future phishing campaigns. Defenders should immediately block the domain and its resolved IP at perimeter firewalls and DNS filtering solutions. Adding the domain to internal blocklists, monitoring for newly created domains that resolve to the same IP range, and correlating any user‑reported Fidelity NetBenefits login attempts with this indicator are recommended. Continuous observation of threat‑intel feeds for additional pulses referencing the same IP or certificate will help detect potential re‑deployment of the infrastructure.