tornadocashclassic[.]com

This domain is flagged as an elevated-risk Ethereum brand impersonation threat designed to deceive users into interacting with fraudulent private transaction services. The infrastructure mimics legitimate privacy tools to exploit trust in decentralized finance protocols, specifically targeting users seeking anonymity in blockchain transactions.

Analysis indicates tornadocashclassic.com was registered through Spaceship, Inc. on February 23, 2026, and resolved to IP address 188.114.97.3. The domain appears on three security blocklists and is detected by 5 out of 95 security vendors on VirusTotal. A Gridinsoft trust score of 0/100 further confirms its malicious classification. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, suggesting an attempt to leverage reputable infrastructure to evade detection. The page title, 'Tornado Cash - Private Transactions on Ethereum,' directly impersonates a well-known privacy service, increasing the likelihood of successful social engineering.

Mitigation requires immediate action from both users and security teams. Users should verify domain authenticity by cross-referencing official project documentation and avoiding interaction with unofficial or recently registered domains. Security teams should implement domain blocklisting at the network level, particularly for domains mimicking privacy-focused services. Monitoring for similar impersonation patterns—such as domains combining 'tornado,' 'cash,' and 'classic'—can help preemptively identify related threats. Additionally, enforcing strict transaction verification protocols, such as confirming contract addresses through trusted sources, reduces the risk of financial loss from fraudulent interactions.