fidelityworkplaceq[.]qpon

PhishDestroy has identified a dangerous phishing domain, fidelityworkplaceq.qpon, which specifically impersonates Fidelity Investments to steal NetBenefits login credentials. This threat is classified as a generic phishing attack, elevated risk, and has been taken offline. The domain was created on February 21, 2026, and despite its short lifespan, it managed to appear on two security blocklists and was flagged by 18 out of 95 VirusTotal security vendors, indicating widespread recognition as malicious. The domain resolves to IP address 74.48.108.25 and its SSL certificate is rated E7, a low-grade certificate often used by fraudulent sites. AlienVault OTX recorded this domain in 14 distinct threat intelligence pulses, further confirming its malicious nature.

The phishing page was titled "Log In to Fidelity NetBenefits," designed to deceive users into entering sensitive account information. The domain's registration through an unknown registrar and its recent creation date are typical red flags for phishing campaigns. PhishDestroy's analysis confirms that the site is now offline, but the threat remains significant due to potential data breaches that may have occurred while it was active. The elevated risk level is justified by the high number of security vendor flags and the brand impersonation of a major financial institution.

Users who may have interacted with this domain should immediately change their Fidelity NetBenefits passwords and enable two-factor authentication. PhishDestroy recommends monitoring account statements for unauthorized activity and reporting any suspicious login attempts to Fidelity's security team. Organizations should update their web filters to block this domain and educate employees about phishing tactics that mimic trusted financial portals. Continuous vigilance is essential, as similar domains may appear under different top-level domains or with slight variations in the domain name.