fidelityworkplacely[.]click

This domain, fidelityworkplacely.click, operates as a credential harvesting platform specifically designed to impersonate the legitimate Fidelity NetBenefits login portal. Analysis indicates the site presents a fraudulent interface to deceive users into submitting sensitive financial credentials, including usernames, passwords, and potentially multi-factor authentication codes. The threat actor’s objective appears to be unauthorized access to retirement accounts, employer-sponsored benefits portals, or other financial services managed through Fidelity’s infrastructure. The use of a login page title identical to the authentic Fidelity NetBenefits service increases the likelihood of successful deception, particularly among employees or plan participants expecting routine access to their accounts. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, an anomalous future date suggesting potential registrar manipulation or domain generation algorithm abuse. It resolves to the IP address 43.162.124.172, hosted within autonomous system AS132203, a network segment previously associated with bulletproof hosting providers. Security vendors have flagged the domain in 18 out of 95 detection engines on VirusTotal, with additional listings on two independent security blocklists. The SSL certificate, identified as E8, lacks proper validation and does not correspond to Fidelity’s legitimate certificate authority chain, further confirming its fraudulent nature. Users who accessed fidelityworkplacely.click or entered credentials on the site should immediately initiate remediation protocols. Affected individuals must change passwords for all financial accounts, particularly those associated with Fidelity or employer benefits portals, using a secure, non-compromised device. Multi-factor authentication should be enabled or revalidated to prevent unauthorized access. Financial institutions and benefits administrators should be notified of potential exposure, and transaction histories should be reviewed for unauthorized activity. System-level scans for malware or keyloggers are recommended, as credential harvesting sites often deploy secondary payloads to maintain persistence. Organizations should also consider implementing domain monitoring to detect similar impersonation attempts targeting their user base.