tornadocash2[.]pages[.]dev

This domain, tornadocash2.pages.dev, poses a high-risk threat as an Ethereum brand impersonation site designed to deceive users into interacting with fraudulent smart contracts or wallet interfaces. The site mimics the legitimate Tornado Cash platform, presenting itself under the title 'Tornado Cash | Swap Ethereum' to lure victims into connecting wallets or approving malicious transactions. Such impersonation typically aims to drain cryptocurrency assets by exploiting trust in established brands, often through fake swap or staking interfaces that trigger unauthorized transfers upon user interaction. Analysis indicates the domain was registered on April 20, 2025, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.84, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate. Security vendors have flagged the domain, with 3 out of 95 engines on VirusTotal detecting malicious activity. Additionally, the domain appears on two security blocklists, including PhishDestroy and ScamSniffer, further confirming its fraudulent nature. If a user has visited tornadocash2.pages.dev or interacted with its content, immediate action is required. First, revoke any smart contract approvals granted to unknown or suspicious addresses using a blockchain explorer or wallet interface. Next, disconnect the wallet from all decentralized applications (dApps) and run a full scan for malware or unauthorized extensions. Monitor transaction history for unauthorized transfers and report any stolen assets to the relevant platform or authorities. Users should also avoid reusing passwords or seed phrases associated with the compromised session and enable transaction simulation tools to preview actions before approval.