fidelityworkplacees[.]click

Analysis of fidelityworkplacees.click shows a short‑lived infrastructure used to harvest credentials for Fidelity NetBenefits. The domain was registered on 21 February 2026 and resolved to the IP address 43.162.112.221, which is hosted in the United States under ASN 132203 (Tencent Building, Kejizhongyi Avenue). The site presented the page title “Log In to Fidelity NetBenefits”, indicating an attempt to lure employees or plan participants into entering their login information. The SSL certificate is rated E7, providing minimal cryptographic assurance.

VirusTotal recorded 12 positive detections out of 93 scanned scanners, confirming that multiple security engines classify the host as malicious. The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy service. AlienVault OTX references the domain in fourteen separate threat‑intel pulses, reinforcing its reputation as a recurring phishing vector. Gridinsoft assigned a trust score of 0 / 100, the lowest possible rating.

Current status shows the site taken offline, but the underlying IP and hosting provider remain active and could be reused for future campaigns. Defenders should add 43.162.112.221 to network deny lists, monitor DNS queries for the domain and its sub‑domains, and enforce URL filtering rules that block the exact host. Incident response teams should also alert users about credential‑harvesting attempts targeting Fidelity NetBenefits and advise immediate password changes for any accounts that may have been exposed. Continuous threat‑intel feeds, including OTX and VirusTotal updates, should be consulted for re‑appearance of the domain or related indicators.