tornadocash-site[.]github[.]io

This domain, tornadocash-site.github.io, is identified as a high-risk brand impersonation threat targeting the Across protocol. Analysis confirms the domain is actively impersonating Tornado Cash, a well-known cryptocurrency mixer, to deceive users into engaging with fraudulent content. The domain remains operational as of the latest verification, posing an ongoing risk to individuals interacting with decentralized finance (DeFi) platforms. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MarkMonitor, Inc., a registrar commonly associated with legitimate enterprises but also exploited for malicious purposes. The domain resolves to the IPv6 address 2606:50c0:8000::153, hosted under AS54113 (Fastly, Inc.) in the United States. Despite its deceptive design, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating potential evasion of automated detection systems. However, it appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (R12), a common but not inherently malicious certificate authority. The page title, 'Tornado Cash | Home Website,' further corroborates the intent to mimic the legitimate Tornado Cash platform. Current status confirms the domain remains active, with no takedown or mitigation efforts observed. Users are strongly advised to avoid interaction with tornadocash-site.github.io and any associated links or resources. Network administrators should implement DNS-level blocking for the domain and its resolving IP address. Individuals who may have engaged with the domain should immediately revoke any connected wallet permissions, monitor for unauthorized transactions, and report the incident to relevant security teams. Given the domain's impersonation of a high-profile cryptocurrency service, heightened vigilance is recommended for all users within the DeFi ecosystem.