tornadocash-app[.]net

This domain, tornadocash-app.net, is flagged as an active brand impersonation site targeting Amazon. Registered on July 25, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to an IPv6 address (2600:9000:27e6:d800:7:49a5:5fd5:9881) hosted on Amazon.com, Inc. infrastructure (AS16509). The page title, 'Amazon.com. Spend less. Smile more.,' directly mirrors Amazon's official branding, confirming the impersonation intent. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, with nameservers carol.ns.cloudflare.com and roan.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), and the domain currently returns an HTTP 200 status, indicating active operation. The domain appears on one security blocklist and has been flagged by one of 95 security vendors on VirusTotal. While the exact content and functionality of the site remain unanalyzed, the combination of Amazon branding, Cloudflare hosting, and active resolution suggests a high-risk phishing operation. Defenders should prioritize blocking this domain at the DNS and network levels, monitor for related certificates, and investigate potential credential harvesting or fraudulent transaction activity associated with this infrastructure. The registration age (under one year) and use of a well-known registrar are consistent with typical phishing domain patterns.