fidelityworkplacers[.]qpon

This domain, fidelityworkplacers.qpon, is flagged as a banking phishing site impersonating Fidelity NetBenefits, as indicated by its page title 'Log In to Fidelity NetBenefits' and the scam type classification in threat intelligence sources. Registered on November 17, 2025, through Gname.com Pte. Ltd., the domain resolved to IP address 74.48.108.25, hosted under AS35916 (MULTACOM CORPORATION) in the United States. The infrastructure was taken offline by the time of this assessment, though its prior operational status is confirmed by detection data. Analysis reveals the domain was detected by 19 of 95 security vendors on VirusTotal, indicating broad recognition as malicious.

It appears in 14 AlienVault OTX threat intelligence pulses and is listed on at least one security blocklist, specifically PhishDestroy. The SSL certificate (E7) provides no additional trust indicators, and Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. No evidence suggests the use of a known phishing kit or additional brand impersonation beyond the Fidelity NetBenefits login page. Defenders should treat this domain as confirmed malicious infrastructure, particularly targeting financial or employee benefits login credentials.

While the site is currently offline, historical DNS and WHOIS records should be preserved for forensic purposes. Organizations should monitor for any re-emergence of this domain or similar variants under the same registrar or hosting provider. If internal logs show user interaction with this domain prior to takedown, credential resets and account audits are recommended for affected users. No further content analysis is available, as the site is no longer accessible for inspection.