fidelityworkplaceet[.]click

This domain, fidelityworkplaceet.click, is identified as a credential theft operation specifically targeting users of Fidelity NetBenefits. Analysis indicates the site presents a fraudulent login interface mimicking the legitimate Fidelity platform, designed to harvest usernames, passwords, and potentially multi-factor authentication codes. The primary objective is unauthorized access to retirement accounts, brokerage services, or other financial assets managed through Fidelity’s systems, enabling subsequent fraudulent transactions or identity theft. Infrastructure analysis reveals the domain resolves to IP address 43.162.12.221, hosted on AS132203 within a data center in the US. The domain was registered on February 21, 2026, an unusually future-dated creation that may indicate registrar manipulation or bulk registration abuse. As of the latest scan, 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate, identified as E8, lacks valid trust chain indicators, further suggesting its illegitimate nature. Users who visited fidelityworkplaceet.click or entered credentials on the site should immediately revoke any active sessions on legitimate Fidelity platforms and change their passwords. Enable multi-factor authentication if not already active, and monitor account statements for unauthorized transactions. If financial data was exposed, consider placing a fraud alert with credit bureaus. Network administrators should block the domain and associated IP 43.162.12.221 at perimeter defenses to prevent further access attempts. Report the incident to relevant financial fraud response teams for additional mitigation steps.