[WARNING] malicious TRON energy renting site with an exploit kit loader

[Zwei]

what happened:

found this user on the services board looking for promoters for his TRON rental platform, but the website actually has a hidden iframe with a loader targeting devices running iOS between versions 18.1 and 18.7 for a remote code execution (RCE) exploit.



i'm not an expert at this, so i had gemini analyze the loader code, and this was its conclusion:



and this for the boot.js



according to gemini this is a Drive-By-Download Exploit Kit, and it's some nasty stuff:



user profile link: https://bitcointalk.org/index.php?action=profile;u=3766679
topic: https://bitcointalk.org/index.php?topic=5592678.0 / https://archive.is/dRk5Z

website: (DOT NOT OPEN)

Code:

tron11.com

reference links: https://www.virustotal.com/gui/url/14b8745778ac9f0a63240cb028122a3c281f6316a9c53e3cb57d3dc3a49d9c63/detection

stay safe everyone.

[robelneo]

Good catch! I thought it was a Ponzi scheme because there have been so many Ponzi schemes have been linked to the Tron network in the past.
I got a notification from my AV. I thought it was a false positive, but your investigation proved that there is a hidden agenda behind that platform.

[hugeblack]

I noticed that the topic was deleted. In such cases, report it and the topic will be deleted + account will be banned, as posting these links violates the forum rules. Flag supported.

[Arhad]

At the very least, this is not just one site, but a network of domains:

Code:

Domain: vuuu.io
Registered On: 2026-08-15
Abuse Email: complaint@gname.com

Archive: https://ghostarchive.org/archive/A1g1d

Code:

Domain: tron22.com
Registered On: 2026-08-17
Abuse Email: rtr-security-threats@realtimeregister.com

Archive: https://ghostarchive.org/archive/37fA8