Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
pufferfi-e9t.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 13 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 1.9 years oldRegistered history | Clear |
| Web archive | Archived since 20248 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2024.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This is a single-page website published on a shared Cloudflare Pages subdomain under the title "Puffer: Staking for the Little Fish". It presents itself as a staking service aimed at small-scale participants. The captured homepage holds only a short block of text, and the site has no independently registered brand domain. Its apparent purpose is to promote a crypto-asset staking offering.
Scam/Impersonation Risk
The principal contradiction is reputational and severe. Several major security engines currently classify the site as malicious, including three tier-one vendors. The site is therefore blacklisted by external threat sources, and this is the decisive factor in the assessment. No conflicting legal-entity names were observed, and no brand impersonation was confirmed at page level. The risk comes from the adverse detections and the context around them. A staking product, which by nature asks visitors to commit digital assets, sits on a generated-looking free-hosting subdomain rather than an established brand domain. The staking service is also not recognised in any DeFi protocol directory, so its claims have no independent footing. Automated behavioural testing found no wallet-drainer activity, clipboard manipulation, hidden forms or cloaking. That absence does not outweigh the detections, because a page can change its behaviour after testing.
- Homepage: presents a staking brand with minimal content and no verifiable operator, and the service is not listed in the DeFi protocol directory.
- Threat reputation: flagged as malicious by multiple security engines, three of them tier-one vendors, with no benign explanation in the evidence.
- Behavioural sandbox (three runs): 76 external fetch requests and 2 external POST submissions, all to whitelisted destinations. No wallet-connect, clipboard-write, hidden-form or cloaking activity was recorded.
- Domain provenance: about 1.9 years old, with 8 archive snapshots spanning 2024-12-08 to 2025-04-08 (2 years tracked) and no content repurposing detected.
Regulatory Verification Notes
The homepage gives no corroborated operator identity, and the real-world entity behind the service is not independently established. This ownership opacity compounds the reputational concern for a service that invites asset commitments. No licence or registration for handling crypto-assets is evidenced, and no regulator or third-party database coverage was found. Because the broker-reputation dataset returned no match, there is no third-party signal in either direction. The site does not present any independent recognition on which legitimacy could rest.
- Transport encryption: TLS certificate issued by WE1 at domain-validation (DV) level, valid to 2026-12-18 (49 days remaining). DV confirms only control of the domain, not the identity of an organisation.
- Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).
- Homepage: staking is offered without any visible licensing, registration or corporate-entity statement.
What to Verify Next
The first step is to establish whether this deployment is operated by any genuine project using the "Puffer" name. Official links should be taken only from independently trusted sources, such as a project's verified social accounts or a directory listing reached by a separate route, never from this site or from links that lead to it. If the operator claims to be regulated, the claim should be checked directly in the relevant national financial-regulator registry. The adverse security detections should be re-checked after any remediation, and the site should not be treated as cleared until they are withdrawn. Official support and contact channels should also be confirmed through an offline or independent route.
- Homepage: the staking brand sits on a generated subdomain, so a legitimate project, if one exists, should be traceable to a separate primary domain.
- Threat reputation: the current detections would need to be withdrawn by the reporting security vendors before any change in posture.
- Homepage: no regulatory registration or licensing reference is available to cross-check.
Summary Verdict
The evidence converges on a critical, high-risk posture. Adverse findings from multiple major security engines are decisive, and the site's technical hygiene cannot offset them. The operator's identity is unestablished, so there is no independent basis to treat the site as legitimate.
Infrastructure Integrity
The site is fronted by Cloudflare's CDN/WAF, and all four observed addresses are edge servers. The origin server was not observable, so hosting cannot be verified independently. Edge-only visibility can also mask rapid content swaps. The protection is a mitigating factor only. It does not vouch for the content published behind it, and the shared Pages platform allows any party to publish a site like this one. It cannot offset the reputation risk.
Closing Assessment
At most, the site should be viewed read-only. No account login, credential entry, wallet connection or funds transfer should take place on it. Anyone who has already interacted with it should change any reused passwords and review the permissions and approvals granted on their accounts and wallets.
Written analysis generated 2026-10-29 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by governance, external reputation, behaviour in a sandbox, registration and ownership.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
04 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of pufferfi-e9t.pages.dev.
- The request stayed on pufferfi-e9t.pages.dev. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2024-12-08. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2c51 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-18 |
| Domain age | 1.89 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2024-12-08 |
| Archive snapshots | 8 |
| Reputation | VirusTotal: 13 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about pufferfi-e9t.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.