Phishing sites impersonating Puffer

PhishDestroy has recorded 20 phishing domains impersonating Puffer since 2025-09-12, 9 of them in the last 30 days. The most used registrars are Dynadot and NameSilo; the most common TLDs are .shop and .xyz. Open Puffer only from its official app or a saved bookmark.

20
Domains, all time
9
Last 30 days
8
Online at last check
1
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 12026-10-03: 02026-10-04: 12026-10-05: 02026-10-06: 12026-10-07: 02026-10-08: 02026-10-09: 12026-10-10: 12026-10-11: 12026-10-12: 02026-10-13: 12026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 12026-10-21: 02026-10-22: 0
Puffer phishing domains detected per day: 9 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake Puffer site

Words most often added to the brand in reported domains: pufferfinance, claimspufferfi, claims, duplicate, disabled, vote, voting, finance, puffler, alandusaboutique.

  • Type the address yourself or use a bookmark; phishing links for Puffer arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Puffer will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Puffer phishing domains

The 20 most recently detected domains impersonating Puffer
DomainFirst detectedStatus at last checkRegistrar
bodecollection.shop2026-10-20OfflineDynadot
bernardofashionsdirect.shop2026-10-13OnlineDynadot
bbcicecreamarchive.shop2026-10-11OnlineDynadot
bancore.shop2026-10-10OnlineDynadot
babyphatshop.shop2026-10-09OnlineDynadot
altovogue.shop2026-10-06OfflineDynadot
animalfashion.shop2026-10-04OnlineDynadot
anycubicics.shop2026-10-02OnlineDynadot
alandusaboutique.shop2026-09-25OnlineDynadot
puffler.finance2026-02-26Taken downGNAME.COM
puffer.express2026-02-26OfflineNameSilo
v3-puffer.net2026-01-25OfflineNiceNIC
pufferfinance-puffer-finance.cc2026-01-25UnknownNiceNIC
app-puffer.xyz2026-01-05OfflineDynadot
voting-puffer.app2025-10-14OfflineCloudflare
vote-puffer.app2025-10-08OfflineCloudflare
duplicate-disabled-6568.invalid2025-09-16OfflineNameSilo
pufferfinance.xyz2025-09-16OnlineNameSilo
claims-puffer.live2025-09-12OfflineNameSilo
claimspufferfi.guru2025-09-12OfflineSav.com

All 20 Puffer reports

Where they are registered and hosted

Registrars

  1. Dynadot9
  2. NameSilo4
  3. Cloudflare2
  4. NiceNIC2
  5. Sav.com1
  6. Dynadot1
  7. GNAME.COM1

Top-level domains

  1. .shop9
  2. .xyz2
  3. .app2
  4. .guru1
  5. .live1
  6. .invalid1
  7. .cc1
  8. .net1

Hosting networks

  1. CLOUDFLARENET, US8
  2. Malakmadze Web LLC5
  3. malakmadze Malakmadze Web LLC, GE4
  4. Cloudflare, Inc.2
  5. RAILNET Railnet LLC, US1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Puffer; share of all PhishDestroy reports: 0.01%.