fidelityworkplaceeq[.]click

fidelityworkplaceeq.click was registered on 21 February 2026 and resolves to the IPv4 address 43.162.112.221. The IP is allocated to AS132203 in the United States, specifically a Tencent Building on Kejizhongyi Avenue. The host presents an SSL certificate with an E7 rating, indicating weak encryption. The site’s page title is “Log In to Fidelity NetBenefits”, aligning with the observed scam type of banking phishing. Threat intelligence from AlienVault OTX lists the domain in fourteen separate pulses, reflecting repeated sightings across different feeds.

PhishDestroy has actively blocked the domain, and it appears on a single external security blocklist. Gridinsoft assigns a trust score of zero out of one hundred, confirming a reputation of high maliciousness. VirusTotal analysis shows fifteen of ninety‑three scanning engines flag the domain, reinforcing the malicious assessment. The domain is currently listed as offline, and its status is recorded as taken offline by the reporting source. The available evidence suggests that the infrastructure was deliberately provisioned to impersonate Fidelity’s NetBenefits portal in order to harvest credentials.

No additional content or behavioral data is publicly available, leaving the full scope of the campaign uncertain. Defenders should continue to block the IP address 43.162.112.221, add fidelityworkplaceeq.click to local and network‑wide deny lists, and monitor for any resurgence of the domain or related subdomains. Ongoing correlation with OTX pulse identifiers and the PhishDestroy blocklist can assist in early detection of future iterations. Organizations using Fidelity NetBenefits should educate users about the illegitimate login page and enforce multi‑factor authentication where possible.