fidelityworkplacebv[.]one

The domain fidelityworkplacebv.one has been analyzed and identified as a credential theft threat, specifically targeting users of the Fidelity NetBenefits platform. This domain impersonates a legitimate login page with the intent to deceive users into revealing sensitive information. The domain was registered through Gname.com Pte. Ltd. and is part of a broader pattern of brand impersonation attacks aimed at stealing credentials.

Technical analysis reveals that fidelityworkplacebv.one resolves to the IP address 43.162.115.222, which is located in the United States under AS132203. The domain was created on February 02, 2026, indicating a relatively new and possibly opportunistic registration. It has been flagged by 21 out of 95 security vendors on VirusTotal, suggesting a significant level of malicious activity associated with it. The domain appears on one security blocklist and has been blocked by PhishDestroy. The SSL certificate associated with this domain is identified as E7.

Currently, the domain has been taken offline, reducing immediate risk to users. However, the presence of this domain on security blocklists and its identification by numerous security vendors highlight the ongoing threat of credential theft attacks targeting brand platforms. Users are advised to remain vigilant and verify the authenticity of URLs before entering sensitive information. Organizations should enhance monitoring of domain registrations and employ protective measures against brand impersonation threats.