🔍 Indicators of Compromise (IoCs)

Detection Signatures & Hunting Queries

Network IoCs

Malicious Domains

Domain	Purpose	Severity	Status (verified 2026-09-20)
tronify.rent	Primary attack website (impersonates the real "Tronify" TRON energy-rental brand)	CRITICAL	Active — resolves to 185.178.208.133, fronted by DDoS-Guard, homepage last modified 2026-09-14
lending.fhogu.pw	Payload host (greenbid.js drainer) + C&C backend	CRITICAL	Active — resolves via Cloudflare anycast (104.21.94.164 / 172.67.138.20), payload last modified 2026-08-30, `/tron/config` actively serving live attacker addresses

Note the two tiers of infrastructure use two different reverse-proxy providers — DDoS-Guard for the phishing frontend, Cloudflare for the payload/C&C host — which obscures both true origin servers and means a single provider takedown request won't remove both.

Malicious URLs

https://tronify.rent/ https://tronify.rent/index.html https://lending.fhogu.pw/greenbid.js?v=1 https://lending.fhogu.pw/greenbid.js

Backend C&C Endpoints

All 12 endpoints below were extracted directly from the live payload on 2026-09-20 (regex search for /tron/[a-zA-Z0-9_/-]+ against the downloaded file, preserved at evidence/payload/greenbid.js):

https://lending.fhogu.pw/tron/config https://lending.fhogu.pw/tron/balances/{address} https://lending.fhogu.pw/tron/notify/wallet-connected https://lending.fhogu.pw/tron/notify/visit https://lending.fhogu.pw/tron/approve/notify https://lending.fhogu.pw/tron/notify/sweep https://lending.fhogu.pw/tron/notify/approve-rejected https://lending.fhogu.pw/tron/notify/tx-proposed https://lending.fhogu.pw/tron/funding/initiate https://lending.fhogu.pw/tron/funding/status/{address} https://lending.fhogu.pw/tron/client-log https://lending.fhogu.pw/tron/walletconnect

An earlier draft of this list had 8 entries; direct extraction found 4 more (/tron/balances/, /tron/client-log, /tron/funding/status/, /tron/walletconnect).

DNS Detection

DNS Query Patterns:

# Monitor for DNS queries to:
tronify.rent
lending.fhogu.pw

# YARA Rule Example:
rule detect_tronify_dns {
    strings:
        $domain1 = "tronify.rent" nocase
        $domain2 = "lending.fhogu.pw" nocase
    condition:
        any of them
}
            

Network Traffic Patterns

HTTP Request Signatures:

# Monitor for HTTP requests to lending.fhogu.pw with:
# - Path: /greenbid.js
# - Method: GET
# - Response: JavaScript, ~150KB

# Suricata Rule Pattern:
alert http $HOME_NET any -> $EXTERNAL_NET any
  (msg:"Tronify Drainer Payload Download";
   content:"GET /greenbid.js";
   http_uri;
   pcre:"/greenbid\.js/";
   sid:1;)

# Monitor for POST requests to lending.fhogu.pw with:
# - Path: /tron/* (any C&C endpoint)
# - Content-Type: application/json
# - Body contains: visitorId, address, walletName, etc.

alert http $HOME_NET any -> $EXTERNAL_NET any
  (msg:"Tronify C&C Exfiltration";
   content:"POST /tron/";
   http_uri;
   content:"application/json";
   http_header;
   sid:2;)
            

File IoCs

JavaScript Payload

Attribute	Value	Severity
Filename	greenbid.js	CRITICAL
Size	150,274 bytes	HIGH
SHA-256	0f6d64472d6369a098f403db117b1285e79b0fdac79caaa639fc0e50e5bf4416	CRITICAL
File Type	JavaScript (text/javascript), served via Cloudflare	Info
Location	https://lending.fhogu.pw/greenbid.js?v=1	CRITICAL

The SHA-256 hash is the single most reliable file IoC here — unlike string signatures, it can't be evaded by attacker string obfuscation, but it also breaks the instant the attacker changes even one byte of the file. Use both.

String Signatures

Unique strings found in greenbid.js payload:

"tron-drainer:visitor-id" "tronSpender" "tronSweepAddress" "tronSweepMinTrx" "/tron/config" "/tron/notify/wallet-connected" "/tron/approve/notify" Y("drain" "already approved" "sweeping" "TRX sweep result" "lending.fhogu.pw"

YARA Signatures

rule Tronify_Drainer {
    meta:
        author = "Security Researcher"
        description = "Tronify.rent wallet drainer payload"
        severity = "critical"
        date = "2026-09-20"
        hash_sha256 = "0f6d64472d6369a098f403db117b1285e79b0fdac79caaa639fc0e50e5bf4416"
    strings:
        $s1 = "tron-drainer:visitor-id"
        $s2 = "tronSpender"
        $s3 = "tronSweepAddress"
        $s4 = "lending.fhogu.pw"
        $s5 = "/tron/config"
        $s6 = "/tron/approve/notify"
        $s7 = "Y(\"drain\"" nocase
        $s8 = "already approved"
    condition:
        5 of them
        // Correction: an earlier draft of this rule added a magic-number check
        // "uint32(0) == 0x28666928" claiming it matched the IIFE opening "(function(){".
        // That check was wrong on the arithmetic (little-endian uint32 of the literal
        // bytes "(fun" is 0x6E756628, not 0x28666928) and would never have matched —
        // it's removed rather than "fixed" to a byte-exact match, since attackers can
        // trivially add a leading comment or whitespace and break a magic-number
        // condition anyway. The 8 string signatures are the durable part of this rule.
}

rule Tronify_Website {
    meta:
        author = "Security Researcher"
        description = "Tronify.rent malicious website content"
        date = "2026-09-20"
    strings:
        $domain = "tronify.rent"
        $company = "Tronify Energy Solutions LLC"
        $payload = "greenbid.js" nocase
        $contact = "hello@tronify.rent"
    condition:
        3 of them
}

rule Tronify_C2_Config {
    meta:
        author = "Security Researcher"
        description = "Tronify C&C configuration endpoint"
    strings:
        $host = "lending.fhogu.pw"
        $endpoint1 = "/tron/config"
        $endpoint2 = "/tron/notify"
        $json = "tronSweepAddress"
    condition:
        $host and 2 of ($endpoint*) and $json
}
        

Web Behavioral IoCs

Browser Console Activity

When greenbid.js executes, it logs debug messages to browser console:

Console Logging Pattern:

Y("drain", "no tron spender configured")
Y("drain", `found ${n.length} tokens`)
Y("drain", `${r.symbol}: already approved`)
Y("drain", `sweeping ${u} sun TRX`)
Y("drain", `TRX sweep result: ...`)
Y("connectTronLink candidates:", JSON.stringify(w))

// These messages appear in console if user opens DevTools
// Search for "drain" in console to detect attack
            

localStorage Activity

Drainer stores visitor ID in localStorage:

localStorage Signature:

// Browser DevTools > Application > Local Storage
// Look for:
Key: "tron-drainer:visitor-id"
Value: "550e8400-e29b-41d4-a716-446655440000" (UUID format)

// Detection JavaScript:
if (localStorage.getItem("tron-drainer:visitor-id")) {
    console.warn("Tronify drainer detected in localStorage");
}
            

Blockchain IoCs

TRON Wallet Addresses (Attacker Destinations)

The attacker's destination addresses are not hardcoded in greenbid.js — they're loaded dynamically from /tron/config. That endpoint is live and unauthenticated, so we queried it directly on 2026-09-20 and got real values, then verified them on-chain via TronGrid/TronScan (raw responses in evidence/onchain/).

Address Type	Address (as of 2026-09-20 — will rotate)	On-chain status
Token Spender (`config.tronSpender`)	`TV6n8cCLmX5mRCMMNvcE1K1i87Yo9Ys5rv`	Created 2026-07-23; last active 2026-09-19; currently holds 14,635.00 USDT + 875.44 TRX
TRX/Token Sweep Destination (`config.tronSweepAddress`)	`TLv3iSnZxWghEmadLDzuAK2p5GkAwg7tpJ`	Created 2026-07-23 (39s after the spender address); currently holds 32,288.30 USDT + 3,213.53 TRX; received USDT from ~25 distinct addresses in the last 30 transfers (2026-08-27 to 2026-09-19)
Exchange contract (`config.tronExchangeContract`)	`TDE7vfjJuYqEzzKw6hfdSB3dfLQyXDYPux`	Deployed smart contract (not an EOA); on-chain account_name decodes to "TronEnergy"
Observed consolidation targets (funds moved from the sweep address)	`TVkRFwgyvUrJqGe3xZaZvTj4vxM5bzherw` (received 24,000 USDT, 2026-08-19) `TZ2PfDN5wNcsrabcB2JoMagx8vY7VEmQqX` (received 6,000 USDT, 2026-08-16)	Not yet traced further — good next pivot points for law enforcement / chain analysts, since they represent where funds go after theft rather than the (more easily rotated) collection point

Caveat: because the C&C config is fetched fresh on every visit, the attacker can change these addresses at any time without redeploying greenbid.js. Treat the specific addresses above as a dated snapshot for pivoting/tracing, not a permanent blocklist entry — re-query /tron/config periodically if operationalizing this.

Smart Contract Interaction Pattern

Blockchain observation patterns for exploit detection:

TRON Chain Analysis (TronScan):

// Look for transactions that indicate draining activity:

// 1. Multiple victims approving unlimited token access to SAME spender
SELECT
    event_type = "Approval"
    AND amount = "115792089237316195423570985008687907853269984665640564039457584007913129639935"  // uint256 MAX
    GROUP BY spender
    HAVING COUNT(DISTINCT owner) > 10
    WITHIN 24 hours;

// 2. Multiple token transfers from different wallets to SAME destination
SELECT
    event_type = "Transfer"
    AND amount > 1000000  // Large amounts
    GROUP BY to_address
    HAVING COUNT(DISTINCT from_address) > 5
    WITHIN 24 hours;

// 3. Rapid TRX balance depletions to same destination
SELECT
    event_type = "NativeTransfer"
    WHERE from_balance_before >> from_balance_after  // Significant loss
    GROUP BY to_address
    HAVING COUNT(DISTINCT from_address) > 5
    WITHIN 24 hours;
            

TronScan Hunting Strategy

Without known attacker addresses, look for exploitation patterns:

# Search for unlimited approvals (uint256 MAX value):
https://tronscan.org/#/token/explorer?type=approval&amount=115792089237316195423570985008687907853269984665640564039457584007913129639935

# Look for addresses with large approval patterns
Search for wallets that have made identical approvals to same spender

# Monitor for cascading TRX transfers
Look for patterns where multiple unrelated wallets transfer TRX to same address

# Note: Attacker may rotate addresses frequently, making individual address hunting ineffective

# NEW, higher-confidence heuristic (from the verified "gas-funding" mechanism in
# technical_architecture.html): look for a SINGLE address sending ~15 TRX to many
# otherwise-unrelated wallets, each of which shortly afterward sends an unlimited USDT
# approval followed by a full-balance transfer to the SAME spender/destination pair.
# The funding step is a stronger fingerprint than the sweep itself, because the attacker
# has to reuse a funding source repeatedly (spending it is a cost), while the sweep
# destination is cheap to rotate.
        

User Behavior IoCs

Phishing Landing Patterns

Users who visit tronify.rent exhibit predictable behavior patterns:

User Journey Indicators:

Google search for "TRON energy rental" or similar
Visit tronify.rent homepage
Scroll to bottom, read (fake) company info
Click "Connect Wallet"
Approve wallet connection in wallet extension
Page loads; wait 5-30 seconds for dApp to initialize
Multiple wallet notifications for token approvals appear
User confirms each notification
Wallet balance drops to ~0 (realizes theft)
Posts on Reddit/Twitter for help

Social Media Indicators

Victims post on public channels after exploitation:

# Reddit search patterns:
site:reddit.com "tronify" "scam"
site:reddit.com "tronify.rent"
site:reddit.com "wallet drained" "tronify"

# Twitter search patterns:
site:twitter.com "tronify.rent"
site:twitter.com "@tronify_team" complaint
site:twitter.com "#tronify" scam

# Telegram group warnings:
# Many TRON community groups warn members about tronify.rent
# Monitor group messages for "tronify" mentions
        

Detection Methods by Platform

For Web Application Firewalls (WAF)

# ModSecurity Rule
SecRule RESPONSE_BODY "@rx lending\.fhogu\.pw" \
    "id:1000,phase:4,log,deny,msg:'Malicious domain detected'"

# Cloudflare WAF
(http.response.code == 200 and
 (http.response.content contains "lending.fhogu.pw" or
  http.response.content contains "greenbid.js"))
        

For DNS Security

# Pi-hole blocklist entry:
0.0.0.0 tronify.rent
0.0.0.0 lending.fhogu.pw
0.0.0.0 www.tronify.rent

# Bind9 zone file:
tronify.rent    IN  A  127.0.0.1
lending.fhogu.pw IN  A  127.0.0.1

# OpenDNS/Cisco Umbrella blocklist:
Add to "Malware" category
        

For Endpoint Detection (EDR)

# Monitor browser extensions/add-ons for:
- TronLink wallet extension
- MetaMask extension
- WalletConnect

# Monitor browser cache for:
- greenbid.js downloads
- lending.fhogu.pw connections
- tronify.rent cookies/storage

# Monitor process execution:
- Chrome/Firefox child processes connecting to lending.fhogu.pw
- TronLink plugin sending data to C&C
        

Temporal IoCs

Campaign Timeline

Date	Event	Evidence	Confidence
2026-07-23	Attacker's spender and sweep addresses created (39 seconds apart)	TronGrid `create_time` field on both addresses (evidence/onchain/)	Confirmed (on-chain)
2026-08-16 to 2026-09-19	Active theft window observed in most recent transaction page	~25 distinct USDT senders into the sweep address; two consolidation transfers out (evidence/onchain/trc20_transfers_tronSweepAddress_page1.json)	Confirmed (on-chain)
2026-08-30	Payload last modified	`Last-Modified` HTTP header on greenbid.js (evidence/payload/)	Confirmed (HTTP header)
2026-09-14	tronify.rent homepage last modified	`Last-Modified` HTTP header on the site (evidence/site/)	Confirmed (HTTP header)
2026-09-19 22:12	Spender address's most recent on-chain activity	TronGrid `latest_opration_time`	Confirmed (on-chain)
2026-09-20	This verification pass: live payload, C&C config, and on-chain data all pulled directly	All files in `evidence/`, checksummed in `evidence/SHA256SUMS.txt`	Confirmed (direct collection)
~2026-06 (unverified)	A YouTube video titled around "Tronify.rent Review" exists	Found via web search; we did not verify the video's upload date, view count, or that its content specifically calls the site a scam	Unverified — do not cite as campaign-launch evidence

False Positive Prevention

The Real "Tronify" Brand — and Why This Isn't a Simple Typosquat

Correction: an earlier draft of this document asserted that tronify.app, tronify.llc, tronrental.com, and tronified.com were confirmed-legitimate alternatives, without checking them. We checked. Results below are from direct DNS resolution and HTTP requests on 2026-09-20 (raw output in evidence/dns/resolution_snapshot.txt and evidence/site_legit/) — do not point users at any of these as a "safe alternative" without re-verifying first, since domain status changes and an expired domain can be re-registered by anyone, including a threat actor:

Domain	Live status (checked 2026-09-20)	Note
tronify.app	No DNS record (does not currently resolve)	Appeared in search results as "TRONIFY — Rent TRON Energy," but is not live now
tronify.llc	No DNS record	Not currently live
tronified.com	No DNS record	Not currently live
tronify.pro	Resolves, but 302-redirects to google.com	Dead/abandoned, not offering any service
tronify.io / tronify.ai	Live, resolving, serving a real single-page app (Chinese-language TRON energy/bandwidth rental + TRX staking product)	The only Tronify-branded domain in this set we found to be genuinely live and serving a product as of this check

Why this matters more than a typosquat table: a third-party crypto news article reports that Trust Wallet integrated a service called "Tronify" for automatic energy rental — meaning the brand "Tronify" carries real, independently-earned trust in this space. tronify.rent is not a misspelling of one specific competitor; it's occupying the same brand name under a different, unusual TLD (.rent) in a space where several legitimate-sounding "Tronify" domains are already dead or abandoned. A user who searches "is Tronify legit" will find genuinely positive results that say nothing about which TLD they apply to. We could not confirm whether the "Tronify Energy Solutions LLC, EIN 87-2945163" registration displayed on tronify.rent belongs to a real filed entity, was copied from a real one, or was invented — none of the other Tronify-branded sites we checked displayed that specific EIN for comparison, so this remains an open question rather than a settled one.

Reporting IoCs

Where to Report

TRON Community: TRON DAO Forum (forum.tron.org)
Blockchain Security: TronScan team, TRON Foundation security@tron.network
Wallets: TronLink, Trust Wallet, MetaMask security teams
DNS Registrars: Report domain abuse to domain registrar
Hosting Providers: Report abuse to lending.fhogu.pw hoster
Security Research: TRON security research communities, Twitter security accounts