[WARNING] malicious TRON energy renting site with an exploit kit loader

[Zwei]

what happened:

found this user on the services board looking for promoters for his TRON rental platform, but the website actually has a hidden iframe with a loader targeting devices running iOS between versions 18.1 and 18.7 for a remote code execution (RCE) exploit.



i'm not an expert at this, so i had gemini analyze the loader code, and this was its conclusion:



and this for the boot.js



according to gemini this is a Drive-By-Download Exploit Kit, and it's some nasty stuff:



user profile link: aalice888999
topic: https://bitcointalk.org/index.php?topic=5592678.0 / https://archive.is/dRk5Z

website: (DOT NOT OPEN)

Code:

tron11.com

reference links: https://www.virustotal.com/gui/url/14b8745778ac9f0a63240cb028122a3c281f6316a9c53e3cb57d3dc3a49d9c63/detection

flag: https://bitcointalk.org/index.php?action=trust;flag=3585

stay safe everyone.

[robelneo]

Good catch! I thought it was a Ponzi scheme because there have been so many Ponzi schemes have been linked to the Tron network in the past.
I got a notification from my AV. I thought it was a false positive, but your investigation proved that there is a hidden agenda behind that platform.

[hugeblack]

I noticed that the topic was deleted. In such cases, report it and the topic will be deleted + account will be banned, as posting these links violates the forum rules. Flag supported.

[Arhad]

At the very least, this is not just one site, but a network of domains:

Code:

Domain: vuuu.io
Registered On: 2026-08-15
Abuse Email: complaint@gname.com

Archive: https://ghostarchive.org/archive/A1g1d

Code:

Domain: tron22.com
Registered On: 2026-08-17
Abuse Email: rtr-security-threats@realtimeregister.com

Archive: https://ghostarchive.org/archive/37fA8

[Zwei]

At the very least, this is not just one site, but a network of domains:

yep, there are so many of them, i did a quick search and i found a few others:

Code:

Domain: ck887.com
Registered On: 2026-08-25
Abuse Email: complaint@gname.com

Code:

Domain: usdt01trx.com
Registered On: 2026-08-07
Abuse Email: abuse@nicenic.net

Code:

Domain: 230.aapk01.com
Registered On: 2026-06-28
Abuse Email: complaint@gname.com

also found a trust wallet version possing as "Trust Wallet AI Beta Partner Recruitment" as bait:

Code:

Domain: cku77.com
Registered On: 2026-08-25
Abuse Email: complaint@gname.com

and a binance version for checking "wallet security" to protect yourself from hackers, quite ironic:

Code:

Domain: binance-2026.com
Registered On: 2026-07-27
Abuse Email: abuse@nicenic.net

Code:

Domain: binance226.icu
Registered On: 2026-07-24
Abuse Email: abuse@nicenic.net

there are probably much more out there.

[JeromeTash]

Great investigative work @Zwei!

I am supporting the flag and also giving the member a red tag. I am surprised the moderators have not nuked his account for such a malicious attempt.

I noticed that the topic was deleted. In such cases, report it and the topic will be deleted + account will be banned, as posting these links violates the forum rules. Flag supported.

I tried to sneak around the post deletion by creating another topic, but this time round with no website in the OP - Looking for Active Crypto Community Contributors

The flag and red trust will be helpful