fideiltyprgwc[.]qpon

This domain, fideiltyprgwc.qpon, was identified as a banking phishing site targeting users of Fidelity NetBenefits, as indicated by the page title 'Log In to Fidelity NetBenefits.' Registered on November 13, 2025, through Gname.com Pte. Ltd., the domain resolved to IP address 43.162.109.164, hosted on AS132203 within a Tencent-operated infrastructure located in the US. Analysis reveals a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, both indicating high-risk classification. The domain appears on at least one security blocklist and was flagged by 17 of 95 security vendors in a VirusTotal scan, though the specific detection context remains unverified. The SSL certificate, rated E7, suggests potential misconfiguration or malicious intent, as lower-grade certificates are often associated with phishing infrastructure.

The site was blocked by PhishDestroy and is currently offline, though defenders should treat this as a temporary state rather than a permanent takedown. Defenders are advised to review network logs for connections to 43.162.109.164 or DNS queries for fideiltyprgwc.qpon, particularly from endpoints accessing financial or benefits-related services. The domain's registration details, including the use of a low-reputation registrar and hosting provider, align with common phishing infrastructure patterns.

While the exact phishing kit or payload is not confirmed, the page title and scam type classification indicate credential harvesting targeting Fidelity users. No evidence of additional malicious artifacts, such as malware distribution or lateral movement, is present in the available data. Organizations should update blocklists to include this domain and IP, monitor for resurgence under similar naming conventions, and alert users to potential phishing attempts referencing Fidelity NetBenefits.