fidelityworkplacekf[.]click

This domain, fidelityworkplacekf.click, poses as a legitimate Fidelity NetBenefits login portal to deceive users into entering sensitive financial or personal credentials. The site is designed to harvest login details, which attackers may use for unauthorized account access, identity theft, or financial fraud. Given the domain’s targeting of workplace retirement and benefits platforms, the potential impact includes corporate data breaches and individual financial loss. Analysis indicates the domain was registered on December 1, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious infrastructure. It resolves to the IP address 43.162.124.172, hosted on AS132203 in the United States, and is flagged by 12 out of 95 security vendors on VirusTotal. The page title, 'Log In to Fidelity NetBenefits,' directly mimics the legitimate Fidelity platform, and the domain appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate (E7) is non-standard, further suggesting illegitimate use. If a user visited fidelityworkplacekf.click and entered credentials, they should immediately change passwords for all associated accounts, particularly those tied to financial services. Enable multi-factor authentication where available and monitor accounts for unauthorized transactions. Report the incident to the legitimate service provider and consider placing a fraud alert with credit bureaus. The domain has since been taken offline, but users should remain vigilant for similar phishing attempts.