fidelityworkplacekl[.]click

This domain, fidelityworkplacekl.click, was registered on 2025-12-01 through Gname.com Pte. Ltd. and points to the IP address 43.162.124.172, which is hosted in the United States under ASN 132203 belonging to Tencent. The site presents the page title “Log In to Fidelity NetBenefits”, indicating an attempt to impersonate Fidelity’s NetBenefits portal. VirusTotal scans have recorded detections by 12 of 93 security vendors, and the domain appears on one external blocklist. PhishDestroy has taken the domain offline, and the current HTTP status is reported as offline.

The SSL certificate is identified as “E8”, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. AlienVault OTX lists the domain in four threat‑intelligence pulses, further corroborating its use in banking‑phishing campaigns. The combination of a low‑trust SSL rating, multiple vendor detections, blocklist presence, and confirmed offline status suggests the domain was actively used for credential‑stealing against Fidelity NetBenefits users before takedown.

Uncertainty remains regarding the exact phishing kit employed and any additional infrastructure such as command‑and‑control servers, as these details were not disclosed in the available intelligence. Defenders should continue to block the domain at perimeter and DNS layers, monitor for related indicator‑of‑compromise activity targeting the 43.162.124.172 address, and update web‑filter and email‑gateway rules to flag any URLs or messages referencing “Log In to Fidelity NetBenefits”. Analysts should also query recent logs for attempts to resolve or contact this domain and consider sharing the indicator with threat‑sharing communities to aid broader detection.