tornadocashdao[.]com

Analysis of tornadocashdao.com, created on February 23, 2026, shows a high‑risk generic phishing infrastructure targeting users of the Tornado Cash service. The site presents the page title "Tornado Cash Official | Private ETH, USDT & BNB Transactions," indicating an attempt to masquerade as the legitimate Tornado Cash platform. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States, and is served behind Cloudflare with Browser Insights and HTTP/3 enabled. SSL is issued by Google Trust Services under the WE1 certificate, which provides a valid TLS handshake but does not attest to the legitimacy of the underlying content. Nameservers nola.ns.cloudflare.com and yoxall.ns.cloudflare.com further confirm reliance on Cloudflare’s DNS infrastructure.

Two of ninety‑three VirusTotal security vendors have flagged the domain, and it appears on three external blocklists. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have already listed the domain as malicious, reinforcing the suspicion of phishing activity. The registrar listed is Spaceship, Inc., a known bulk registration service, and the Gridinsoft trust score is 0 out of 100, indicating an extremely low reputation.

The HTTP response is a 301 redirect, which may be used to forward victims to a credential‑stealing endpoint or to obscure the final landing page. While the exact payload or credential‑capture mechanism has not been publicly disclosed, the convergence of a brand‑specific page title, low trust scores, vendor detections, and blocklist entries provides sufficient evidence for defensive action.

Defenders should block both the domain and its resolved IP at perimeter firewalls and DNS filtering solutions. Endpoint protection suites should be updated to include the domain in their URL reputation feeds.