fidelityworkplacemv[.]click

The domain fidelityworkplacemv.click was registered on 21 February 2026 and is presently taken offline after being blocked by the PhishDestroy mitigation service. DNS resolution maps the name to the IPv4 address 43.162.124.172, which is hosted in the United States and associated with ASN 132203, a Tencent‑owned network located on Kejizhongyi Avenue. The server presents an SSL certificate identified only as “E8”, providing transport‑layer encryption but offering no indication of legitimate ownership. A single security blocklist lists the domain, and the Gridinsoft trust scoring system assigns it a score of 0 out of 100, reflecting an extremely low reputation.

VirusTotal analysis shows that 16 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. The observed page title is “Log In to Fidelity NetBenefits”, indicating that the site is crafted to lure victims into entering credentials for Fidelity’s NetBenefits portal, which classifies the operation as banking‑phishing. The threat is labelled as a generic phishing campaign targeting financial accounts. While the domain’s infrastructure points to a Tencent AS and the hosting IP, no further information about the registrar, underlying web‑application kit, or additional payloads has been disclosed.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the same IP or certificate fingerprint. Incident response teams handling credential compromise should verify whether any user accounts associated with Fidelity NetBenefits have been exposed and enforce multi‑factor authentication where possible. Ongoing intelligence collection is advised to track any new domains that reuse the same hosting provider or exhibit similar SSL characteristics.