# tornado-cash.link — SUSPICIOUS

> PhishDestroy warns: tornado-cash.link is a crypto drainer site with 0/95 VirusTotal detections. Verify this domain before connecting your wallet!

## Summary
PhishDestroy identifies tornado-cash.link as a crypto drainer posing as Tornado Cash to steal digital assets from unsuspecting users. This fraudulent site mimics the legitimate Tornado Cash service to trick visitors into connecting crypto wallets, where drainers automatically transfer funds without consent. Always double-check domain spellings and use PhishDestroy's verification tools before interacting with crypto platforms.  This domain was flagged as active on February 02, 2026, with 0 detections out of 95 scanners on VirusTotal, indicating it evades most automated security checks. It was registered through Gname.com Pte. Ltd. and resolves to IP 172.67.130.80, hosted on infrastructure known for malicious activity. Despite using a Google Trust Services SSL certificate, the domain's recent creation and low detection rate make it a high-risk threat to crypto users.  If you visited tornado-cash.link, immediately disconnect your wallet and revoke any suspicious token approvals. Run a malware scan on your device and change passwords for critical accounts. Report the domain to PhishDestroy to help block this threat and prevent others from falling victim. Stay vigilant—crypto drainers evolve quickly, and even legitimate-looking sites can be traps.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-02-02 09:11:39
- Registrar: Gname.com Pte. Ltd.
- IP: 172.67.130.80

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/tornado-cash.link
- PhishDestroy: https://phishdestroy.io/domain/tornado-cash.link/
- LLM endpoint: https://phishdestroy.io/domain/tornado-cash.link/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tornado-cash.link/
Last updated: 2026-04-02