fjdnhhofidelity[.]qpon

The domain fjdnhhofidelity.qpon was observed hosting a page titled “Log In to Fidelity NetBenefits”. The page title directly references Fidelity’s NetBenefits portal, indicating a banking‑phishing campaign that attempts to harvest credentials for a financial service. The domain was registered on 24 November 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 43.162.126.210, which is located in the United States and is associated with ASN 132203, identified as a Tencent Building on Kejizhongyi Avenue. The SSL certificate presented by the site carries the identifier “E8”, suggesting a self‑signed or low‑trust certificate. Gridinsoft’s trust score for the domain is 0 out of 100, and the site appears on a single security blocklist.

Detection services have flagged the domain: 15 of 95 vendors on VirusTotal reported it as malicious, and the domain has been cited in five AlienVault OTX pulses. PhishDestroy has taken the site offline, and the current status is reported as “taken offline”. Nameservers a.share-dns.com and b.share-dns.net are in use. Analysis indicates that the observable infrastructure—recent registration, low trust score, use of generic DNS services, and association with a known phishing blocklist—aligns with typical credential‑harvesting operations targeting Fidelity customers.

The presence of a page title referencing Fidelity NetBenefits confirms the intended victim brand, while the lack of additional public threat intel (e.g., malware kit identifiers) limits deeper attribution. Defenders should block the domain and its resolving IP at perimeter and DNS filters, monitor for related indicators such as the listed nameservers and SSL fingerprint “E8”, and consider adding the domain to internal blacklist feeds. Ongoing surveillance of the ASN and host provider may reveal further related phishing infrastructure.