fidelityworkplacerw[.]cyou

The domain fidelityworkplacerw.cyou was observed serving a login page titled “Log In to Fidelity NetBenefits”. The page title directly indicates an attempt to impersonate Fidelity’s NetBenefits portal, a service used by employees to access retirement and benefits information. The domain was registered through Gname.com Pte. Ltd. on 17 November 2025. DNS resolution points to the IPv4 address 74.48.108.25, which belongs to AS35916 MULTACOM CORPORATION and is geolocated in the United States. Passive threat feeds have correlated the domain with 14 AlienVault OTX pulses, and VirusTotal reports that 14 of 93 scanning engines flagged the host as malicious.

The domain is listed on one external blocklist and has been actively blocked by the PhishDestroy sinkhole. A security rating from Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. The site’s TLS certificate was graded “E8”, reflecting a weak or mis‑configured encryption layer. Current monitoring indicates the site is offline, and the risk level has been classified as elevated.

The evidence confirms a classic banking‑phishing infrastructure targeting Fidelity users, but no additional payloads, command‑and‑control endpoints, or malware families have been disclosed. Because the page content has not been captured, analysts cannot confirm the presence of credential‑harvesting forms or additional redirection mechanisms. Defenders should add the domain and its resolving IP to proxy and firewall deny lists, ensure that endpoint protection solutions incorporate the 14 VirusTotal detections, and monitor for any reuse of the 74.48.108.25 address in future campaigns. Continuous observation of the registrar Gname.com Pte. Ltd. for new registrations with similar naming patterns is advised, as is periodic review of the OTX pulse updates for emerging indicators related to this infrastructure.