puntoborsai[.]com

Analysis of puntoborsai.com shows a newly registered domain created on 21 February 2026 by Internet Domain Service BS Corp. The domain resolves to IP 37.120.247.109, an address owned by AS9009 M247 Europe SRL located in Romania. All four listed nameservers (ns.incogdns.gl, ns.incogdns.me, ns.incogdns.st, ns.incogdns.vg) are under the incogdns label, suggesting use of an anonymizing DNS service. No TLS certificate is presented, indicating HTTP‑only access. The site’s page title – “PuntoBorsa AI - Piattaforma Ufficiale | Trading IA 2025 | Oltre 10.000 Recensioni” – advertises an AI‑driven trading platform and implies a large number of reviews, but the content has not been inspected.

The domain is classified as a brand‑impersonation campaign targeting the “base” brand, and its risk level is marked elevated. Reputation checks are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and four of ninety‑three VirusTotal scanners have flagged the domain. It appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The domain is currently offline, which may be a temporary takedown or a self‑service shutdown after detection.

Uncertainties remain regarding the specific malicious payload or credential‑harvesting mechanisms, as no SSL, page screenshots, or malware samples have been reported. Defenders should continue to deny any network connections to 37.120.247.109, add the domain and its IP to local deny lists, and monitor for any resurgence under related subdomains or alternative DNS providers. Threat intelligence feeds should be updated to reflect the brand‑impersonation tag, and any inbound traffic from the listed nameservers should be inspected for suspicious HTTP requests. Ongoing vigilance is advised, especially for users of the “base” brand who may receive unsolicited communications referencing the advertised AI trading service.