punditsystems[.]com

Analysis of punditsystems.com shows a high‑risk brand‑impersonation campaign targeting Facebook. The domain was registered on January 15, 2024 through NameSilo, LLC and remains active. Technical probing indicates the site resolves to IP address 46.165.235.143, hosted in Germany under AS28753 Leaseweb Deutschland GmbH, and serves HTTP status 200. The certificate is a Let's Encrypt R13 issuance, providing no indication of malicious self‑signed TLS.

The page title returned by the web server is "Medical Business Free - Pundit Systems Ltd," which does not reference Facebook, suggesting the front‑end content has not been publicly examined. Infrastructure fingerprints reveal a WordPress stack backed by MySQL, PHP, and common front‑end libraries such as Bootstrap, Chart.js, Swiper, and Slick, all delivered via LiteSpeed. Nameserver delegation points to rs51.rcnoc.com and rs52.rcnoc.com. Threat intelligence shows three of ninety‑three VirusTotal scanners have flagged the domain, and it appears on two independent blocklists (PhishDestroy and ScamSniffer).

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. While the precise phishing mechanics (e.g., login capture forms) are not disclosed, the convergence of brand targeting, active hosting, low trust scoring, and inclusion on multiple anti‑phishing feeds qualifies the domain as a confirmed impersonation threat. Defenders should block the domain and its resolved IP at perimeter firewalls, update URL filtering policies to include the domain, and monitor the associated nameservers for any rapid changes. Continuous re‑scanning of the site for new payloads is advised, as the current evidence does not reveal the full content of the malicious page.