Is puep.fun a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This is a recently registered website on the ".fun" top-level domain. The analysis could not retrieve its real content. The only page captured was a Cloudflare interstitial titled "Suspected Phishing", returned with an access-denied status. That page contained very little text, so the site's products, services and business model could not be determined from what it presented. The page gave no identifiable brand or operator.

Scam/Impersonation Risk

This site carries confirmed adverse reputation signals. It is currently blacklisted by multiple independent security-intelligence sources, several of which classify the domain as malicious rather than merely suspicious. That convergence is the decisive factor in the assessment. Hosting behind a mainstream CDN, a valid certificate and a Cloudflare challenge layer do not offset it. The Cloudflare warning page that stood in for the site's content points the same way and should be read as a corroborating signal, not an independent confirmation. No brand impersonation or conflicting legal identities were observed, because no identity content could be reviewed. Behavioural testing found no wallet-connection prompts, clipboard manipulation, hidden forms or credential posts to external hosts. Those were absent in the limited content that rendered, which is not evidence that the site is benign. The browsing sessions did show heavy third-party traffic: more than a hundred external background requests, with nearly all activity directed to outside hosts. They also showed several external POST submissions, repeated console errors, and a large burst of page-structure changes after interaction. Together these suggest a script-driven page that loads most of its behaviour from elsewhere. The domain's registration history also shows a discontinuity. Archive captures date to late 2024, well before the current registration, which is consistent with a lapsed domain that was re-registered. That pattern is common when expired domains are repurposed, though the evidence does not show what the earlier content was. Evidence:

• Homepage: the only content captured was a Cloudflare interstitial titled "Suspected Phishing", returned with an HTTP 403 status and about 381 characters of text.
• Reputation checks: four malicious and two suspicious verdicts from multiple security engines, with an external blacklist hit confirmed.
• Domain provenance: registered 2026-09-02 (about 52 days old), while the web archive holds 7 snapshots spanning 2024–2026 (3 years tracked), with the earliest capture in November 2024.
• Behavioural sandbox, 3 runs: 122 external background requests, 5 external POSTs, 10 console errors and 1,508 page mutations after interaction.

Regulatory Verification Notes

The content reviewed contained no legal, terms, privacy, about or licensing pages, so no regulatory status or corporate identity could be assessed. No third-party broker or regulator profile matched this domain, and no independent link between the site and any real-world brand or person could be established. The site therefore cannot be treated as a regulated or licensed financial service on the available evidence. Its registration was made through the Dynadot registrar and is recent. Under the current adverse reputation findings, any regulatory or licensing claim the site might later make would carry no assurance without independent confirmation. Evidence:

• Registration: Dynadot LLC registrar; created 2026-09-02, expiring 2027-09-02.
• Transport security: the TLS certificate was issued by WE1 with domain-validation (DV) only, valid to 2026-12-01, which confirms encryption but not operator identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• No broker or regulator database entry matched the domain.

What to Verify Next

Any contact with this site should first be checked against an independent, offline route to the supposed operator. Prospective users should confirm that the claimed brand or business exists and that its official domain is this one, using regulator registers and the organisation's known official channels, not links or details taken from the site. If the domain appeared in an unsolicited email, message, advertisement or social post, the sender should be verified separately and the message reported. Site owners or administrators who believe the listing is mistaken should check whether the domain was re-registered after a previous holder, and should request re-evaluation with the security vendors that list it. Evidence:

• Reputation: the confirmed blacklist and malicious detections make independent confirmation of the operator a precondition for any engagement.
• Provenance: archive captures that predate the current registration suggest the domain's earlier use should be checked against the present operator.
• No official support or contact channel was available to confirm.

Summary Verdict

The overall posture is high risk. The site's reputation has been compromised by confirmed third-party detections, and its recent registration and absent identity disclosures leave nothing credible to counterbalance them. The available evidence does not support treating it as legitimate for any sensitive purpose.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses are Cloudflare edge servers, with no origin server visible. That is a mildly mitigating factor, since the infrastructure is mainstream and the certificate is valid. It does not offset the reputation findings. Edge-only visibility also prevents independent verification of where the content is actually hosted, and it can mask rapid content changes.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction, and nothing should be downloaded from it. At most, cautious read-only viewing in an isolated environment is acceptable. Anyone who has already submitted credentials or funds should change affected passwords and contact their bank or payment provider immediately.