fideiltyprgwc[.]cyou

On 23 July 2026 investigators examined the newly registered domain fideiltyprgwc.cyou, which was created on 21 February 2026. DNS resolution points to the IPv4 address 43.162.109.164, an address hosted in the United States and associated with ASN 132203 (Tencent Building, Kejizhongyi Avenue). The site served a page whose HTML title reads “Log In to Fidelity NetBenefits”, a clear indication of a banking‑phishing lure targeting Fidelity customers. The SSL certificate presented an E7 grade, offering a superficial appearance of legitimacy while providing minimal cryptographic assurance.

Automated scanning on VirusTotal returned detections from 13 of 93 security engines, confirming the presence of malicious indicators. AlienVault OTX records show the domain appearing in fourteen independent threat‑intel pulses, and it is currently listed on one public blocklist as well as being flagged by the PhishDestroy sinkhole service. Independent reputation scoring from Gridinsoft assigned a zero‑out‑of‑hundred trust score, reinforcing the malicious classification. The combined evidence – recent registration, low‑reputation hosting, phishing‑oriented page title, multiple vendor detections, and inclusion in OTX pulses – leads to an elevated risk rating.

Defenders should immediately block the domain and its resolved IP at perimeter firewalls and proxy layers, add the address to DNS‑based blocklists, and monitor for any outbound connections to the host. Continuous re‑evaluation is advised because the site status is reported as offline, but the infrastructure may be reused for future campaigns. Organizations that process Fidelity‑related credentials should educate users about the specific lure and enforce multi‑factor authentication where possible.