fidelityworkplaceq[.]cyou

The domain fidelityworkplaceq.cyou was registered through Gname.com Pte. Ltd. on 17 November 2025. Passive DNS records show it resolves to the IPv4 address 74.48.108.25, which is announced by AS35916 MULTACOM CORPORATION and geolocated to the United States. The authoritative nameservers listed for the zone are A4.SHARE-DNS.COM and B4.SHARE-DNS.NET. The site’s HTTP response, captured before the takedown, returned the page title “Log In to Fidelity NetBenefits”, indicating a targeted banking phishing campaign against Fidelity NetBenefits users. The phishing classification is confirmed by the supplied scam type “Banking Phishing”. Multiple defensive feeds have flagged the domain.

PhishDestroy has already blocked it, and it appears on one external security blocklist. VirusTotal analysis reports that 16 of 93 scanning engines returned a positive detection for the domain, reinforcing the malicious verdict. AlienVault OTX lists the domain in 13 separate threat‑intel pulses, demonstrating continued circulation among threat‑sharing communities. Reputation services rate the site extremely poorly, with Scamadviser assigning a trust score of 1 out of 100 and Gridinsoft reporting a score of 0 out of 100. The SSL certificate associated with the host is identified only as “E7”, without further public details, suggesting a self‑signed or low‑quality certificate commonly used by phishing operators.

The current operational status is offline, indicating that the site has been taken down or otherwise rendered inaccessible, but the historical evidence remains relevant for detection. Defenders should ensure that any outbound connections to 74.48.108.25 are denied, and the domain name should be added to local and network‑wide blocklists. Monitoring of the two authoritative name servers for any re‑registration attempts is advisable.