fidelityqouddpr[.]qpon

The domain fidelityqouddpr.qpon was observed as a brand‑impersonation site targeting Fidelity customers. The site presented the page title “Log In to Fidelity NetBenefits” and was classified under the scam type “Banking Phishing”. Registration data shows the domain was created on 24 November 2025 through Gname.com Pte. Ltd., and it resolves to the IP address 43.162.126.210, which is located in the United States and associated with AS132203 (Tencent Building, Kejizhongyi Avenue). No SSL certificate was present at the time of analysis, indicating that communications were not encrypted. The domain is currently offline, and its HTTP status was not captured because the service was taken down before a response could be recorded.

Detection telemetry indicates that 17 of 95 security vendors on VirusTotal flagged the domain, reflecting a moderate level of consensus among scanners. Independent reputation services assign extremely low trust scores: Scamadviser rates the site 1 / 100, and Gridinsoft assigns a score of 0 / 100. The domain appears on a single security blocklist and is listed in sixteen AlienVault OTX pulses, confirming its inclusion in broader threat‑intel feeds. PhishDestroy has also blocked the domain, reinforcing its identification as malicious.

Infrastructure analysis reveals the use of shared DNS services, with nameservers a.share-dns.com, a3.share-dns.com, b.share-dns.net, and b3.share-dns.net, a pattern commonly observed in fast‑flux or disposable hosting environments. The combination of a low‑reputation registrar, shared DNS, lack of TLS, and multiple vendor detections suggests an opportunistic phishing campaign rather than a sophisticated, persistent threat.

Defenders should update endpoint and network filtering rules to block resolution of fidelityqouddpr.qpon and the associated IP 43.162.126.210. Email security gateways should be configured to flag messages containing references to “Log In to Fidelity NetBenefits” or similar phrasing.