tornairdrop[.]pages[.]dev

The domain tornairdrop.pages.dev has been identified as a brand impersonation threat, specifically targeting users with a fake airdrop scam that mimics the legitimate Tornado.cash platform. This domain was created on May 03, 2026, and is registered through Cloudflare, Inc., resolving to IP address 188.114.96.3. The page title displayed is 'Tornado.cash', further indicating the attempt to deceive visitors into believing they are on an official site.

Technical analysis reveals that the domain has a VirusTotal score of 12 out of 95 security vendors flagging it as malicious, underscoring its dangerous nature. It is registered with Cloudflare, a common registrar for phishing sites, and its SSL certificate is issued by Google Trust Services (WE1). The domain appears on one security blocklist, and its current status is offline, though it remains a risk if reactivated. The IP address 188.114.96.3 is associated with the domain, and the domain's creation date is relatively recent.

As of the latest assessment, the domain has been taken offline, but users should remain vigilant as similar domains may appear. PhishDestroy recommends that users avoid interacting with any unsolicited airdrop offers and verify URLs carefully. If you have visited this domain, change your passwords and monitor your accounts for suspicious activity. Always rely on official sources for cryptocurrency airdrops and use security tools to block known malicious domains.