fidelityworkplaceil[.]one

This domain, fidelityworkplaceil.one, was registered on March 4, 2026, and is assessed as a high-risk phishing infrastructure targeting financial services. Analysis indicates the domain previously resolved to IP 45.150.34.247, hosted under AS205775 (NEON CORE NETWORK LLC) in the Netherlands. The page title, 'Log In to Fidelity NetBenefits,' explicitly identifies the intended brand impersonation, aligning with the reported scam type of banking phishing. As of the report date, the domain is offline, though historical data confirms its use in social engineering campaigns, as flagged by Google Safe Browsing.

Security vendors on VirusTotal detected the domain, with 15 of 94 engines classifying it as malicious. The domain appears on at least one security blocklist and was blocked by PhishDestroy. The SSL certificate, identified as E8, provides no additional trust indicators. Defenders should treat this domain as confirmed phishing infrastructure, particularly for credential harvesting targeting Fidelity customers.

While the current offline status limits active risk, historical DNS and detection records justify continued monitoring and blocking. No evidence links this domain to broader phishing kits or additional campaigns, and the exact content served remains unanalyzed. Organizations should review logs for connections to the IP or domain and alert users who may have interacted with it prior to takedown.