fidelityworkplacerv[.]help

fidelityworkplacerv.help was created on November 17 2025 and is currently taken offline. The domain is registered through Gname.com Pte. Ltd. and resolves to the IPv4 address 74.48.108.25, which is assigned to AS35916 MULTACOM CORPORATION located in the United States. The site was observed serving a page whose title reads "Log In to Fidelity NetBenefits", matching a banking phishing campaign that targets Fidelity customers. The domain appears on a single security blocklist and has been referenced in fourteen AlienVault OTX threat‑intelligence pulses.

VirusTotal analysis shows that eighteen of ninety‑three scanning engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. Gridinsoft assigned a trust score of 0 out of 100, and the domain has been blocked by the PhishDestroy mitigation service. The SSL certificate is identified as type E7, but no further certificate details are available. The combined evidence—registrar information, hosting IP, blocklist presence, OTX references, vendor detections, low trust score, and the Fidelity‑oriented page title—indicates that the domain was used for a banking phishing operation.

The current offline status prevents immediate interaction, but the infrastructure remains observable and could be re‑activated. Defenders should continue to block the domain and the associated IP address at perimeter and DNS layers, add the domain to internal phishing blocklists, and monitor for any re‑registration attempts or similar patterns. Ongoing vigilance is advised, as the underlying hosting provider may serve additional malicious payloads under different domain names.