puffsol[.]top

Analysis dated July 24 2026 flags the domain puffsol.top as a Google brand impersonation site used for wallet/seed phishing. The domain was registered through NameSilo, LLC on 5 October 2025 and is hosted on the IP address 45.67.85.152, which resolves to a Kuroit Limited network in the United Kingdom (AS203363). The authoritative name servers are ns1.dnsowl.com, ns2.dnsowl.com and ns3.dnsowl.com. No TLS certificate is presented, indicating that HTTPS is not available for the site. The page title returned by the HTTP response is “Puff”, but the content has not been publicly disclosed.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal reports that 11 of 95 security engines flag the domain, and two independent blocklists (PhishDestroy and ScamSniffer) have already listed it. AlienVault OTX includes the domain in a single threat‑intelligence pulse, confirming its presence in the broader threat‑sharing community. The current offline status suggests the site has been taken down, yet the infrastructure remains observable and could be re‑activated by the operators.

Uncertainty remains regarding the exact phishing landing page layout, the specific wallet or seed collection mechanisms, and whether additional command‑and‑control infrastructure exists beyond the listed IP. Defenders should continue to block the domain at DNS and web‑filter layers, monitor the associated IP range for new host registrations, and enforce strict email authentication for any Google‑related communications. Threat‑intel feeds should be updated to retain the domain in blocklists, and analysts should watch for new domains that reuse the same name‑server set or ASN, as these patterns often indicate a continued campaign. Ongoing observation of VirusTotal and other multi‑engine scanners is recommended to detect any changes in classification.