app-tornadocash[.]rf[.]gd

Analysis of app-tornadocash.rf.gd indicates an active infrastructure that aligns with generic credential harvesting campaigns. The domain was registered on August 25, 2013 through Key-Systems GmbH and continues to resolve to the IPv4 address 185.27.134.164. Authoritative name servers are ns1.infinityfree.com and ns2.infinityfree.com, both associated with the free hosting provider InfinityFree. The domain remains live as of the report date, July 15, 2026. No public threat intelligence currently identifies a targeted brand or service, and the site content has not been examined, leaving the exact phishing lure uncertain. The absence of detections in the most recent VirusTotal scan (95 vendors) does not constitute validation of safety, as the scan result reflects only the lack of known signatures at the time of analysis. Defenders should treat the domain as suspicious, enforce outbound URL filtering to block connections to 185.27.134.164, and consider adding the domain to blocklists used by email gateways and web proxies. Continuous monitoring of DNS queries for the associated nameservers and periodic re‑scanning of the host are recommended to detect any future malicious payloads or changes in behavior.