puffs.com

.com crawl

First seen 2026-05-30 · Last seen 2026-06-01 · ok HTTP/1.1 200 387 ms crawled 2026-05-31

US · 150.171.109.34 · AS8075 Microsoft Corporation

Reputation 94/100 dmarc monitor-only

Classifying

HTML metadata

Title: Puffs Facial Tissues
Description: Whether you're feeling a bit runny or suffering from allergy sniffles, we have a tissue for everything your face has to face! Trust your nose to Puffs.
Language: en
Canonical: https://puffs.com/en-us

Technology

CDN: Azure Front Door
CMS: Next.js
JS framework: Next.js

Analytics

Google Analytics
Google Tag Manager

Third-party hosts loaded (3)

images.ctfassets.net×33
www.googletagmanager.com×3
www.google-analytics.com×1

Social

Registration

Registrar

CSC Corporate Domains, Inc.

Created

1995-08-07

Expires

2026-08-06 64 days left

Updated

2025-08-02

Name servers

ns1-09.azure-dns.com
ns2-09.azure-dns.net
ns3-09.azure-dns.org
ns4-09.azure-dns.info

DNS records live

NS

ns1-09.azure-dns.com
ns2-09.azure-dns.net
ns3-09.azure-dns.org
ns4-09.azure-dns.info

MX

10 bbhm.na.pg.com

TXT

mt-mw-puffs-en-us-prod.azurewebsites.net

Verified for

Google

Email authentication weak

SPF: not published
DMARC: v=DMARC1; p=none; sp=none; fo=1; ri=3600; rua=mailto:dmarc_agg@vali.email;
policy: none (monitoring only) · sp=none
DKIM: no key found at common selectors

Certificate (current)

Sectigo Public Server Authentication CA OV R40

from 2025-09-25 to 2026-10-26

Expires in 145 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://puffs.com/en-us

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: DENY
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://csapi.pg.com/ https://csapi-nonprod.pg.com/ https://mw-ar-recom-prod.pgapi.io/ *.cookielaw.org *.onetrust.com; media-src https://videos.ctfassets.net; style-src 'self' 'unsafe-inline' *; img-src https://* 'self' data: https: blob:; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline'; frame-src *; frame-ancestors * 'self' data: https: blob:
strict-transport-security: max-age=31536000; includeSubDomains preload