fidelityworkplacece[.]shop

This domain, fidelityworkplacece.shop, is currently taken offline but historical analysis confirms it operated as a banking‑phishing site. The site was registered through GNAME.COM PTE. LTD. on 22 November 2025 and presented the page title “Log In to Fidelity NetBenefits”, indicating an attempt to lure victims into credential harvesting against the Fidelity NetBenefits service. The hosting resolves to IP 43.162.112.41, which is located in the United States and belongs to ASN 132203, a Tencent‑owned infrastructure segment (Tencent Building, Kejizhongyi Avenue).

The SSL certificate assigned to the domain is rated “E7”, a low‑grade indicator that does not provide strong cryptographic assurance. Reputation data show the domain appears on a single security blocklist and is actively blocked by PhishDestroy. On VirusTotal, 14 of 93 scanning engines flagged the domain, reflecting a moderate detection consensus. AlienVault OTX lists the domain in 13 separate threat‑intel pulses, reinforcing its association with phishing campaigns.

Gridinsoft assigned a trust score of 0 out of 100, effectively marking the domain as completely untrusted. The combined evidence—registrar information, low‑grade SSL, malicious IP ownership, multiple vendor detections, blocklist presence, and OTX pulse count—supports a high confidence rating that the site was used for credential‑stealing targeting Fidelity customers. Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address to network‑level deny lists, monitor for any outbound connections to the resolved host, and update endpoint detection signatures to reflect the 14 VirusTotal detections. Ongoing threat‑intel feeds should be queried for any resurgence of the domain or related indicators, and user‑education campaigns should remind employees that legitimate Fidelity login pages never use the “fidelityworkplacece.shop” domain.