fidelityworkplacecx[.]qpon

Analysis confirms that fidelityworkplacecx.qpon was used for a banking phishing campaign targeting Fidelity NetBenefits users. The site presented the page title “Log In to Fidelity NetBenefits” and was classified as a banking phishing scam. VirusTotal recorded detections from 11 of 93 security vendors, indicating that a notable subset of scanners recognized malicious behavior. The domain appears on one external blocklist and is actively blocked by the PhishDestroy service.

AlienVault OTX references the domain in 14 different threat‑intelligence pulses, reinforcing its association with phishing activity. Infrastructure details show the domain resolves to IP 43.162.112.221, which is hosted in the United States under ASN 132203, a Tencent‑owned network located at the Tencent Building on Kejizhongyi Avenue. The SSL certificate received an E7 rating, suggesting weak cryptographic hygiene. The domain was registered on February 21, 2026 and has since been taken offline, as indicated by its current status.

While the site is no longer reachable, the combination of vendor detections, blocklist entries, and multiple OTX references provides sufficient evidence to treat the domain as malicious. Uncertainty remains regarding the exact phishing kit or any additional payloads that may have been delivered, as no further page content or server response data are available. Defenders should immediately add the domain and its associated IP address to URL filtering and network‑level blocklists, monitor for re‑registration or similar‑looking domains, and enforce strict email authentication controls to reduce successful credential harvesting attempts against the Fidelity NetBenefits brand. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators.