fidelityworkplacech[.]cyou

Analysis as of July 23, 2026 indicates that the domain fidelityworkplacech.cyou was registered on February 21, 2026 and is presently taken offline. The site presented the page title “Log In to Fidelity NetBenefits”, indicating an attempt to masquerade as the official Fidelity NetBenefits portal. DNS resolution points to the IPv4 address 43.162.112.41, which is hosted in the United States and assigned to AS132203, a Tencent‑owned network located on Kejizhongyi Avenue. The SSL certificate observed carries the identifier “E8”, but no further certificate metadata has been disclosed.

Reputation metrics are uniformly negative: Gridinsoft assigned a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has actively blocked it. VirusTotal analysis returned 13 detections out of 93 antivirus scanners, confirming that multiple security vendors flagged the domain as malicious. AlienVault OTX references the domain in fourteen separate threat intelligence pulses, reinforcing its association with a coordinated campaign. The listed scam type is Banking Phishing, targeting Fidelity users, although the specific phishing kit, credential‑harvesting mechanism, or post‑compromise activity has not been publicly observed.

The elevated risk level reflects the convergence of these indicators, even though the infrastructure is currently offline and no live HTTP response can be captured. Uncertainties remain regarding any fallback hosting, persistence techniques, or potential re‑use of the same IP address. Defensive recommendations include adding 43.162.112.41 to network deny lists, monitoring for re‑registration of fidelityworkplacech.cyou or similar Fidelity‑related domain patterns, and correlating internal logs for TLS handshakes presenting the “E8” certificate. Continuous ingestion of OTX pulse updates and periodic VirusTotal rescans are advised to detect possible re‑emergence of the infrastructure.