fidelityworkplaceed[.]click

The domain fidelityworkplaceed.click was registered on November 28, 2025 through Gname.com Pte. Ltd. and is presently taken offline. Infrastructure analysis shows it resolves to the IPv4 address 43.162.112.221, which is located in the United States and is associated with AS132203, a Tencent‑owned network segment at the Tencent Building on Kejizhongyi Avenue. The site presented the page title "Log In to Fidelity NetBenefits," indicating a targeted attempt to harvest credentials for Fidelity's NetBenefits service, consistent with the classified scam type of banking phishing. The SSL certificate attached to the domain is identified as type E8, but no further details about its issuer or validity period are available. Reputation services have flagged the domain: it appears on one security blocklist and is listed by PhishDestroy as a malicious resource.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extreme lack of confidence in the domain’s legitimacy. VirusTotal analysis recorded 13 detections out of 93 scanning engines, confirming that multiple independent security vendors consider the domain malicious. No additional public threat‑intel platforms such as OTX or Safe Browsing are referenced in the supplied data. The combination of a brand‑specific page title, low trust score, multiple vendor detections, and active blocklisting strongly suggests that the domain was used in a credential‑harvesting campaign targeting Fidelity customers.

Because the site is currently offline, immediate traffic may be absent, yet the underlying infrastructure—particularly the hosting IP and associated ASN—remains reusable for future campaigns. Defenders should continue to block the IP 43.162.112.221 at network perimeters, monitor DNS queries for the domain or its subdomains, and add the domain to internal blacklists. Ongoing observation of the hosting ASN for new registrations is advised, as threat actors often recycle compromised or low‑reputation hosting environments.