This is a lapsed-domain problem, not a phishing-sophistication problem. Once OFAC sanctions killed the official Tornado Cash frontend, the domain became a dead asset guaranteed to be re-registered by someone — bookmarks don't expire, but registrations do. Any privacy tool taken offline by regulatory pressure leaves this exact trap for its former users; worth checking if other sanctioned protocol domains are still held by their original teams.