claims-puffer[.]live

This domain, claims-puffer.live, was observed hosting a page whose HTML title resolved to “Nur einen Moment…”. The site was registered through NameSilo, LLC and was served from the Cloudflare network (AS13335) with the origin IP address 188.114.97.3 located in the United States. DNS resolution used the Cloudflare authoritative nameservers julissa.ns.cloudflare.com and nick.ns.cloudflare.com. No TLS certificate was presented, indicating the site operated over plain HTTP. The page was classified as a crypto‑scam that impersonates the brand “puffer”.

The domain has been listed on one security blocklist and was actively blocked by PhishDestroy. VirusTotal analysis recorded six detections out of ninety‑five scanners, confirming malicious intent. As of the report date, the domain is taken offline, and no further HTTP response can be retrieved. The available evidence confirms that the infrastructure leveraged Cloudflare’s edge network, a common tactic to hide origin servers and benefit from the provider’s global CDN. However, the lack of a certificate and the simple page title provide limited visibility into the exact payload or user‑interaction flow.

Defenders should continue to monitor the IP address 188.114.97.3 for any re‑use, enforce outbound filtering to block connections to this host, and add the domain to internal blocklists. Correlation with other Cloudflare‑hosted malicious domains may reveal shared command‑and‑control infrastructure. Because the site is currently offline, any ongoing campaigns must rely on previously distributed links; threat‑hunting teams should search for email or messaging artifacts that reference the URL or the “Nur einen Moment…” title. Additional investigation of the six VirusTotal detections can provide indicator‑of‑compromise (IOC) hashes or URLs that were fetched during the scan, further enriching detection rules.