fidelityworkplacecw[.]click

fidelityworkplacecw.click was observed hosting a page whose title reads “Log In to Fidelity NetBenefits”. The domain was registered on 28 November 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 43.162.112.221, which belongs to AS132203 (Tencent Building, Kejizhongyi Avenue) located in the United States. The site has been classified as a banking phishing operation targeting Fidelity NetBenefits users. Evidence of malicious activity appears in fourteen AlienVault OTX pulses and the domain is listed on a single security blocklist.

PhishDestroy has already blocked the domain, and its Gridinsoft trust score is 0 out of 100, indicating a lack of trustworthiness. VirusTotal analysis shows that fifteen of ninety‑three scanning engines flagged the domain as malicious, reinforcing the phishing assessment. The SSL certificate is identified only as “E7”, providing no additional validation of legitimacy. As of the report date, the site is taken offline, but the infrastructure remains observable.

Defenders should continue to enforce DNS and URL filtering for fidelityworkplacecw.click, add the associated IP address 43.162.112.221 to blocklists, and monitor for any re‑hosting attempts. Given the registrar’s location and the low trust score, further scrutiny of other domains registered through Gname.com Pte. Ltd. is advisable. Ongoing correlation with threat‑intel feeds that reference the fourteen OTX pulses can help detect related campaigns. Until the domain is fully remediated, organizations should advise users to verify any Fidelity NetBenefits login requests through official channels and to report suspicious URLs to their security teams.