puup[.]fun

This domain, puup.fun, is identified as a crypto drainer phishing site designed to compromise digital wallet credentials and siphon cryptocurrency assets. Analysis indicates the site employs deceptive transaction prompts, mimicking legitimate wallet interfaces to trick users into authorizing malicious transfers. The infrastructure is engineered to exploit vulnerabilities in wallet connectivity protocols, enabling unauthorized asset drainage upon interaction. Evidence supporting this assessment includes detection by 16 out of 95 security vendors on VirusTotal, alongside listings on four distinct security blocklists. The domain was registered through Dynadot Inc on March 02, 2026, an unusually future-dated creation that aligns with patterns observed in disposable phishing infrastructure. Hosting is provisioned via Amazon Web Services, with content delivery facilitated by Vercel and jsDelivr, a combination frequently leveraged to obscure malicious payloads. The site resolves to the IP address 188.114.96.3, a host previously associated with transient phishing campaigns. Users who visited puup.fun or interacted with its content should immediately revoke any active wallet authorizations linked to the domain. Disconnect all connected applications from affected wallets and conduct a thorough review of transaction histories for unauthorized activity. If assets were transferred, report the incident to relevant blockchain explorers and law enforcement cybercrime units. Reset credentials for any accounts accessed during the suspected compromise and monitor for anomalous behavior across linked services. Given the high-risk classification, assume all interactions with this domain may have exposed sensitive authentication tokens or private keys.