fidelityworkplaceiv[.]click

This report provides a technical analysis of the domain fidelityworkplaceiv.click, which was identified as a banking phishing domain. The domain was registered on February 21, 2026, and has been flagged as a potential threat. The domain's page title, 'Log In to Fidelity NetBenefits,' suggests that it was designed to mimic a legitimate Fidelity login page, likely to deceive users into providing sensitive information such as usernames, passwords, and financial details. As of the report date, July 23, 2026, the domain has been taken offline, indicating that it may have been shut down by the registrar, hosting provider, or security organizations. Despite the domain being offline, it is important to note that the infrastructure and threat actors behind it may still pose a risk.

The SSL certificate associated with the domain has a rating of E7, which is not a strong indication of trustworthiness. Analysis from Gridinsoft reveals a trust score of 0/100, indicating a high level of suspicion. The domain appears on one security blocklist, further corroborating the elevated risk level. Infrastructure analysis reveals that the domain resolves to the IP address 43.162.112.221, which is located in the United States and is part of the AS132203 Tencent Building network. The domain has been flagged by 15 out of 93 security vendors on VirusTotal, suggesting that it has been recognized as a potential threat by a significant portion of the security community.

Additionally, the domain has been mentioned in 14 threat intelligence pulses on AlienVault OTX, indicating its involvement in multiple security incidents. The domain has been blocked by PhishDestroy, a known security solution. Given the elevated risk level and the evidence of phishing activities, network defenders should ensure that this domain is blocked in their security policies and educate users about the dangers of phishing sites, especially those mimicking financial institutions.