OSINT Tools
[EXIT]
root@defense:~/osint$./recon.sh --target tornado.cash

OSINT Tools

// Reconnaissance commands used in the investigation

Commands Run
8
Categories
5
Findings
8
Status
COMPLETE

INVESTIGATION_SUMMARY

1. Domain tornado.cash resolves to suspicious IP (101.99.75.124)

2. IP belongs to Shinjiru Technology - bulletproof hosting in Malaysia

3. SSL certificate recently issued (Dec 2025) - suspicious timing

4. Source code contains Wayback Machine artifacts (WB$wombat)

5. Site was scraped from archive.org and re-hosted

VERDICT: tornado.cash is a phishing site. Use tornadocash.eth.limo instead.