fidelityworkplacefz[.]click

This domain, fidelityworkplacefz.click, was registered on November 29, 2025 through the Gname.com Pte. Ltd. registrar. The site resolves to the IPv4 address 43.162.112.221, which is announced by AS132203 and geolocated to the United States, specifically a Tencent Building on Kejizhongyi Avenue. The hosting infrastructure has been flagged by multiple security products: PhishDestroy lists the domain on a blocklist, and the domain appears on one additional security blocklist. VirusTotal recorded 11 detections out of 93 scanned vendors, indicating a moderate level of malicious consensus among scanners.

AlienVault OTX references the domain in five distinct threat‑intelligence pulses, further corroborating its reputation as a malicious resource. The SSL certificate presented by the site carries an E8 grade, and the Gridinsoft trust score is 0 out of 100, both of which are consistent with low‑trust, potentially fraudulent hosting. The page title returned by the web server is “Log In to Fidelity NetBenefits”, and the campaign has been classified as banking phishing, targeting users of Fidelity’s NetBenefits portal. The domain is presently taken offline, which limits immediate exposure but does not erase the underlying infrastructure that could be reused.

Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the observed IP address 43.162.112.221, and monitor for any re‑registration attempts or similar domains using the same registrar. Because the underlying IP belongs to a cloud‑provider range, additional scrutiny of traffic to that address is advisable. Incident response teams should also consider the 11 VirusTotal detections as an indicator of potential payload delivery or credential‑harvesting components, and may wish to retrieve the archived payloads for deeper analysis.