fidelityworkplacery[.]qpon

This domain, fidelityworkplacery.qpon, was designed to steal login credentials by impersonating the legitimate Fidelity NetBenefits portal. It posed as a fake login page, tricking users into entering their sensitive account information. The site's page title explicitly read "Log In to Fidelity NetBenefits," a clear attempt to deceive visitors into believing they were on an official Fidelity website. This type of credential harvesting attack is commonly used to gain unauthorized access to financial accounts, potentially leading to identity theft and financial loss.

Evidence of this threat is substantial. VirusTotal flagged the domain with 12 out of 95 security vendors classifying it as malicious. The domain was created on February 21, 2026, and was found on 2 security blocklists. It resolved to IP address 74.48.108.25 and had an SSL certificate issued by E7. Additionally, AlienVault OTX reported its presence in 14 threat intelligence pulses, indicating widespread recognition of its malicious nature. Fortunately, the site has been taken offline, but its past activity remains a concern.

Users who may have visited this domain should immediately change their Fidelity NetBenefits password and enable multi-factor authentication if available. It is also advisable to monitor financial accounts for any unauthorized transactions and report any suspicious activity to Fidelity's security team. For future reference, always verify URLs before entering credentials and use tools like PhishDestroy to check the legitimacy of websites. Staying vigilant against such phishing attempts is crucial for protecting personal and financial information.