fidelitypntched[.]qpon

This domain, fidelitypntched.qpon, operates as a credential theft site specifically targeting users of Fidelity NetBenefits. The page title, 'Log In to Fidelity NetBenefits,' directly mimics the legitimate platform, attempting to deceive victims into entering sensitive login credentials. Analysis indicates the site is designed to harvest usernames, passwords, and potentially multi-factor authentication codes, which could lead to unauthorized access to retirement accounts, financial assets, and personal data. The infrastructure appears optimized for short-term deployment, a common tactic in credential harvesting campaigns to evade detection and takedown efforts. Evidence supporting this assessment includes detection by 17 out of 95 security vendors on VirusTotal, with the domain appearing on two distinct security blocklists. The domain was registered on February 21, 2026, and resolves to the IP address 43.162.126.210, hosted under AS132203 in a data center environment. The SSL certificate, identified as E8, lacks the extended validation typically associated with legitimate financial institutions. The rapid inclusion on blocklists and the domain's current offline status suggest a reactive takedown, though the infrastructure may be repurposed for future attacks. Users who visited fidelitypntched.qpon or entered credentials on the site should immediately take corrective action. Reset passwords for Fidelity accounts and any other platforms where identical or similar credentials may have been reused. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor financial accounts for unauthorized transactions and report suspicious activity to the legitimate service provider. If personal or financial data was exposed, consider placing a fraud alert or credit freeze with major credit bureaus to mitigate potential identity theft risks.