# tornad.cash — SUSPICIOUS

> tornad.cash is a phishing domain now taken offline. Avoid interaction and never share personal info. Stay alert and verify site legitimacy.

## Summary
PhishDestroy identifies tornad.cash as a medium-risk phishing domain designed to steal sensitive information from users. Though now offline, it posed a threat by impersonating legitimate services to deceive visitors.

This phishing scheme likely involved tricking users into entering personal data or credentials, enabling attackers to misuse such information for fraud or identity theft.

If anyone visited tornad.cash, they should remain cautious, avoid sharing any personal details, and monitor their accounts for suspicious activity. Using strong, unique passwords and enabling two-factor authentication is recommended.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: NETIM SAS
- Country: FR
- IP: 172.67.149.126
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["ursula.ns.cloudflare.com", "osmar.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["alphaMountain.ai", "Fortinet", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/01998892-b9f5-703a-8d61-27bc7f85641e.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/29b1eb07-ea65-4460-a192-5e2ec56b42c4
- PhishDestroy: https://phishdestroy.io/domain/tornad.cash/
- LLM endpoint: https://phishdestroy.io/domain/tornad.cash/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tornad.cash/
Last updated: 2026-03-19