fidelityworkplaceaw[.]shop

The domain fidelityworkplaceaw.shop was registered on February 21, 2026 and is presently taken offline. The site presented a page titled "Log In to Fidelity NetBenefits," indicating a targeted attempt to harvest credentials for Fidelity NetBenefits, a known banking service. Technical analysis shows the domain resolves to IP address 74.48.108.25, which is owned by MULTACOM CORPORATION (AS35916) and geolocated to the United States. The SSL certificate associated with the host received an E8 rating, suggesting a low‑trust certificate that is typical of malicious infrastructure.

Reputation services flag the domain as high risk: Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist. VirusTotal scans reported 10 detections out of 93 scanned engines, confirming malicious behavior observed by multiple vendors. AlienVault OTX has incorporated the domain into 14 threat‑intel pulses, reinforcing its classification as a banking phishing vector. PhishDestroy has also blocked the domain, indicating that at least one dedicated anti‑phishing service recognized the threat.

While the site is currently offline, the historical data demonstrates a clear pattern of credential‑stealing activity. Defenders should continue to block the domain at network perimeter controls, update URL filtering policies, and monitor for any future resolution to the same IP range. Continuous observation of the IP 74.48.108.25 for new hostnames is recommended, as threat actors often reuse compromised or rented infrastructure for subsequent campaigns.