fidelityworkplacecw[.]cyou

The domain fidelityworkplacecw.cyoung was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to the IP address 43.162.112.221, which is hosted in the United States and belongs to ASN 132203, identified as a Tencent Building facility on Kejizhongyi Avenue. The site served a page titled "Log In to Fidelity NetBenefits," aligning with a banking phishing classification. Security telemetry shows the domain is blocked by PhishDestroy and appears on a single security blocklist.

The Gridinsoft trust score is 0 out of 100, indicating a lack of trust. VirusTotal analysis recorded 12 detections out of 93 scanning engines, reinforcing the malicious assessment. The SSL certificate was rated E7, a low security grade. The overall risk level is elevated, and the unique seed f1c8d3 ties this observation to a broader investigative dataset.

Known indicators confirm the domain’s use for credential harvesting targeting Fidelity NetBenefits users, but no further payload or post‑exploitation activity has been observed. Uncertainty remains regarding the full extent of the phishing kit, any additional hosting infrastructure, and whether the domain was part of a larger campaign. Defenders should ensure the domain and its associated IP are added to local deny lists, monitor for any resurgence, and consider sinkholing the IP range if feasible. Continuous threat‑intel feeds should be consulted for new detections, and organizations using Fidelity NetBenefits should reinforce user awareness and implement multifactor authentication to mitigate credential‑theft attempts.