fidelityworkplaceit[.]click

The domain fidelityworkplaceit.click has been identified as a generic phishing threat, specifically impersonating the Fidelity NetBenefits login page to steal user credentials. No drainer kit was observed, but the site's primary goal is credential harvesting. The page title, 'Log In to Fidelity NetBenefits,' is a direct copy of the legitimate portal, designed to deceive users into entering sensitive information.

Technical analysis reveals that the domain resolves to IP address 43.162.112.221 and is registered through Gname.com Pte. Ltd., with a creation date of November 30, 2025. VirusTotal flags indicate that 14 out of 95 security vendors consider this domain malicious, and it appears on two security blocklists. Additionally, AlienVault OTX detected it in 14 threat intelligence pulses, and the SSL certificate is rated E8, suggesting weak or fraudulent encryption. Google Safe Browsing status was not explicitly provided but is likely negative given the widespread detection.

As of the latest check, the domain has been taken offline, mitigating immediate risk. However, users who may have visited the site before takedown should change their Fidelity NetBenefits passwords and enable multi-factor authentication. PhishDestroy recommends monitoring accounts for suspicious activity and avoiding clicking on unsolicited links claiming to be from Fidelity. The domain remains on multiple blocklists, so future access attempts will be prevented by security tools.