thrikfrfidelity[.]qpon

The domain thrikfrfidelity.qpon, created on February 21, 2026, resolves to the IPv4 address 43.162.126.210 hosted in the United States. The IP belongs to ASN 132203, an infrastructure operated by Tencent and located on Kejizhongyi Avenue. VirusTotal reports that 16 of 95 security vendors have flagged the domain, indicating a moderate level of detection across scanning services. The site is listed on one security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting an extremely low trust rating.

AlienVault OTX records the domain in three distinct threat intelligence pulses, further corroborating its malicious reputation. The SSL certificate associated with the site is identified by the short tag "E8," which does not correspond to a recognized certificate authority and is typical of hastily provisioned certificates used in fraudulent operations. The page title returned by the server is "Log In to Fidelity NetBenefits," and the campaign is classified as banking phishing, targeting users of Fidelity's NetBenefits portal. Current monitoring indicates the domain has been taken offline and is blocked by the PhishDestroy mitigation service.

While the observed infrastructure confirms a concerted phishing effort, details such as the underlying phishing kit, exact phishing page content, and any credential harvesting mechanisms remain unconfirmed. Defenders should add the domain and its associated IP address to local blocklists, monitor for any related C2 traffic, and update web filtering policies to block requests to this host. Continuous observation of the IP range and related ASN may reveal additional malicious actors employing similar tactics.