tornao[.]cash

The domain tornao.cash is a generic phishing site with no known impersonation of a specific brand or use of a drainer kit. As of the latest verification, tornao.cash poses a generic phishing threat designed to deceive users into disclosing sensitive information. The site has been taken offline, but its previous activity remains under investigation to determine the full scope of the threat.

Technical indicators for tornao.cash show 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing has not issued any warnings. The domain is registered through NETIM SAS, with a creation date of 2026-02-21 07:01:08, and resolves to the IP address 104.21.41.177, hosted by Cloudflare in the US. It appears on 1 security blocklist (PhishDestroy), and its SSL certificate is issued by Google Trust Services / WE1. The domain uses Cloudflare nameservers (elsa.ns.cloudflare.com and norm.ns.cloudflare.com) and returned an HTTP 523 status before being taken offline.

Users who may have interacted with tornao.cash should take immediate safety steps. If credentials or login details were entered, change passwords for all affected accounts and enable two-factor authentication (2FA) where possible. Monitor accounts for unauthorized activity and report any suspected fraud to relevant financial institutions. To assist in mitigation, report the domain to platforms like PhishTank, Google Safe Browsing, or local cybersecurity authorities for further analysis and blocking.