OSINT Tools

// Reconnaissance commands used in the investigation

Scanning Certificate Transparency logs for domains mimicking tornado.cash

VERIFIED SAFE DOMAIN

tornadocash.eth.limo

Official ENS domain - always verify you are on this domain before interacting

Commands Run

1. Domain tornado.cash resolves to suspicious IP (101.99.75.124)

2. IP belongs to Shinjiru Technology - bulletproof hosting in Malaysia

3. SSL certificate recently issued (Dec 2025) - suspicious timing

4. Source code contains Wayback Machine artifacts (WB$wombat)

5. Site was scraped from archive.org and re-hosted

VERDICT: tornado.cash is a phishing site. Use tornadocash.eth.limo instead.

Torn Guard Defence Suite