drnymtpfidelity[.]qpon

Analysis of drnymtpfidelity.qpon indicates that the domain was registered on 24 November 2025 through Gname.com Pte. Ltd. The site presented the page title “Log In to Fidelity NetBenefits”, suggesting an attempt to impersonate Fidelity’s NetBenefits portal. DNS resolution points to IP address 43.162.126.210, which is hosted in the United States and associated with ASN 132203 in the Tencent Building, Kejizhongyi Avenue. The infrastructure has been observed on a single security blocklist and has been blocked by PhishDestroy. Threat intelligence aggregators have recorded the domain in fourteen AlienVault OTX pulses, and fifteen of ninety‑three VirusTotal scanners flagged it as malicious.

The SSL certificate was rated “E8”, indicating a weak or self‑signed certificate. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The domain’s current status is offline, which may be the result of takedown actions or a temporary cessation of activity. Defenders should treat any traffic to or from this domain as potentially hostile.

Immediate actions include adding the IP 43.162.126.210 and the fully qualified domain name to firewall deny lists, updating URL filtering policies, and ensuring that endpoint protection solutions ingest the fifteen VirusTotal detections. Monitoring for similar domain patterns that combine “fidelity” with unrelated top‑level domains is advisable, as the registrar Gname.com Pte. Ltd. has been used in prior phishing campaigns. Because the site is no longer reachable, threat hunters should focus on identifying any residual artifacts, such as credential harvest attempts or emails referencing the fake login page, within their environment. Continuous review of OTX pulse updates and blocklist feeds will help maintain situational awareness as the campaign evolves.