tornadocash-v1[.]com

The domain tornadocash-v1.com has been identified as a brand impersonation threat targeting Microsoft, specifically mimicking the Microsoft Bing search interface. Analysis indicates the domain is designed to deceive users into interacting with a fraudulent search page titled "Suche – Microsoft Bing," suggesting an intent to harvest credentials or distribute malicious payloads under the guise of a legitimate service. The domain is currently classified as under investigation for phishing-related activities. Infrastructure analysis reveals the domain was registered on December 28, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IPv6 address 2a02:26f0:b700:5::210:cc0d and employs an SSL certificate issued by Google Trust Services. Detection metrics indicate minimal initial scrutiny, with 0 of 95 vendors on VirusTotal flagging the domain as malicious. However, it appears on one security blocklist and has been blocked by PhishDestroy. The domain exhibits a Gridinsoft trust score of 0/100, further corroborating its suspicious nature. Technologies detected include Cloudflare and HTTP/3, which may be leveraged to obfuscate malicious activity or enhance delivery speed. As of the latest assessment, tornadocash-v1.com has been taken offline, though the infrastructure remains a potential vector for future malicious campaigns. Organizations and users are advised to treat any residual references to this domain with caution, particularly those involving Microsoft Bing branding. Network administrators should update blocklists to include the domain and its associated IP address, while monitoring for related indicators of compromise. End-users should verify the authenticity of search interfaces and avoid entering credentials on untrusted platforms. Proactive measures, such as domain reputation checks and SSL certificate validation, are recommended to mitigate similar threats.