tornadocash1[.]com

Analysis of the domain tornadocash1.com indicates it is actively impersonating Tornado Cash, a known cryptocurrency mixing service. The domain was registered on March 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 104.21.37.88, which is protected by Cloudflare infrastructure. The site returns an HTTP 521 error, suggesting the web server is intentionally down or misconfigured, a tactic sometimes used to evade detection while maintaining domain registration for future malicious campaigns. Security vendors have flagged this domain, with 13 out of 95 detecting it as malicious. It appears on three security blocklists and has been identified in three threat intelligence pulses, reinforcing its classification as a high-risk phishing domain. The domain is also blocked by multiple security and cryptocurrency-related platforms, further indicating its association with fraudulent activity. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. While the exact content of the site remains unconfirmed due to the server error, the domain name and known intelligence strongly suggest an attempt to deceive users into interacting with a fraudulent Tornado Cash service. Defenders should treat this domain as active and high-risk, blocking it at the network level and monitoring for any attempts to access it. Given its presence on multiple blocklists and threat intelligence feeds, organizations should also investigate any historical connections to this domain within their logs.