fidelityworkplacerw[.]help

Analysis of fidelityworkplacerw.help indicates a deliberately crafted banking phishing campaign targeting Fidelity NetBenefits users. The domain was registered on February 21, 2026 and currently shows an SSL certificate identified as "E8". Infrastructure profiling reveals a single IPv4 address, 74.48.108.25, which belongs to AS35916 operated by MULTACOM CORPORATION and is geolocated in the United States. The host carries a Gridinsoft trust score of 0 out of 100, reflecting an absence of reputation.

The domain appears on one public security blocklist and is blocked by the PhishDestroy feed. Threat intelligence aggregation via AlienVault OTX lists the domain in fourteen separate pulses, reinforcing its malicious classification. VirusTotal scans report that twelve of ninety‑three security vendors flag the domain as malicious, providing additional corroboration. The page title returned from the live endpoint reads "Log In to Fidelity NetBenefits", confirming the intent to impersonate the official Fidelity login portal.

The site is presently taken offline, but its recent creation date and rapid inclusion in multiple intel sources suggest an active, short‑lived phishing operation. Defenders should add 74.48.108.25 to network‑level blocklists, enforce URL filtering for the full domain, and monitor for similar domain‑generation patterns. Continuous re‑scanning of the domain after any potential re‑hosting is advised, as well as awareness campaigns reminding users to verify URLs before entering credential information.