2. whirlwind.money and puremixer.io don't show the cloudfare's anti-TOR page, but the IP addresses these domain names point to still belong to cloudfare, which raises the same suspects as in part 2 of my previous message.