What Gridinsoft observed on tronbid.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261021151422-f1ef9965
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current review supports Safe for the observed tronbid.com deployment. The exact apex and www alias served the expected TRON Energy marketplace without request-profile cloaking or an unrelated redirect; all 90 current sitemap objects were reachable; the reviewed wallet flows required explicit signing for ordinary TRX payment or resource delegation and did not request recovery secrets; public order-book data and recent on-chain activity corroborated an operating service. No malware file, payload, credential receiver, seed-phrase receiver, private-key receiver, automatic download, or exact harmful URL was identified. The previous Suspicious Website state was a broad domain category without a reproducible current harmful object. External reputation and media results were recorded only as context. The principal remaining limitation is incomplete public legal-entity, jurisdiction, refund, and dispute information for an irreversible cryptocurrency-payment service; this is a transparency weakness, not evidence of current malicious behavior.
Analyst findings
Review 9 documented observations View evidence
A fresh supported Gridinsoft rescan reached the expected TronBid page and retained the stored Suspicious Website category, but its current positive-behavior list was empty. The external matrix contained 56 harmless, zero malicious, zero suspicious, and 34 undetected results; direct Avira and Norton checks were Safe and Bitdefender had no record. The active warning was therefore the Gridinsoft category under review rather than a reproduced current harmful object.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/tronbid-com
-
HTTP status
200 -
Final URL
https://tronbid.com/en - Analyst observation The fresh report contained no current positive behavior signal and no external malicious or suspicious result.
Plain HTTP upgraded to HTTPS, the www host redirected to the HTTPS apex, and the apex redirected within the same host to the English route. Desktop, mobile, crawler, and review request profiles received the same 303730-byte English homepage. All 90 objects in the current sitemap returned HTTP 200, including the English, Russian, and Chinese product, dashboard, policy, status, statistics, API-documentation, calculator, and blog surfaces plus the published data files. No unrelated automatic redirect, iframe, meta refresh, executable or archive download was reproduced.
-
HTTP status
200 -
Final URL
https://tronbid.com/en -
Redirect destination
https://tronbid.com/en - Page element Rent TRON Energy, Buy & Sell Energy | TronBid
- Analyst observation Four representative request profiles returned identical English homepage bytes, and all 90 current sitemap objects returned HTTP 200.
- Analyst observation No unrelated automatic redirect, iframe, meta refresh, executable link, archive link, or automatic download was reproduced.
Review of the 65 same-origin JavaScript resources used by the current public pages showed a wallet authentication flow that signs a server challenge, a buyer payment flow that builds a TRX transfer and requires explicit wallet signing, and a seller flow that builds a TRON resource-delegation transaction. The application checks the transaction type and active wallet identity before signing. The reviewed public forms and application code did not expose a seed-phrase, recovery-phrase, private-key, or wallet-password receiver, and no hidden unrelated smart-contract call was identified in the application payment flow.
- Public artifact URL https://tronbid.com/en/dashboard
- Public artifact URL https://tronbid.com/en/quick-rent
- Page element Connect Wallet
- Analyst observation The buyer flow builds a TRX transfer to the displayed payment destination and requires wallet approval; the seller flow builds a resource-delegation transaction.
- Analyst observation No application form or reviewed code path requested a seed phrase, recovery phrase, private key, or wallet password.
The public configuration, statistics, trust-metrics, status, buyer-order, seller-offer, direct-rental, and market-dataset endpoints returned coherent current data. At the review time the service reported 29 active orders, 4868 completed rentals, 799400222 units of Energy, 1313825 units of Bandwidth, and 35829.988436 TRX in total recorded volume. The sampled public order book contained recent partially fulfilled buyer orders and structured seller offers. These totals are service-published records rather than an independent audit, but they expose a consistent live marketplace surface rather than a static payment-only page.
- Public artifact URL https://tronbid.com/api/stats
- Public artifact URL https://tronbid.com/api/public/trust-metrics
- Public artifact URL https://tronbid.com/datasets/tronbid-market-stats.json
- Public artifact URL https://tronbid.com/datasets/tronbid-market-history.csv
- Analyst observation The current public order book exposed 18 buyer orders and 11 seller offers with structured amounts, terms, prices, creation times, and fulfillment values.
- Analyst observation The published totals are service-generated data and were not treated as an independently audited financial statement.
Read-only TRON network queries confirmed that the service address, platform payment address, and public direct-rental address were active accounts. Their current transactions included successful TRX transfers and successful Energy delegation or undelegation operations shortly before the review. The main service address held staked Energy resources and limited resource-delegation permissions, while the direct-rental address delegated Energy to another account. The witness list also associated the main address with the tronbid.com URL. This corroborates current on-chain resource operations, without proving every service-published aggregate or identifying the real-world controller.
- Public artifact URL https://tronscan.org/address/TGcwj4sP1iiSwMrMEPmDw43J1V3CehK7rM
- Public artifact URL https://tronscan.org/address/TL8ihbFbJBRTvPbNjLHTbtgwSCq95bLaFb
- Public artifact URL https://tronscan.org/address/TTspncGbGV1e45jTZnaHuBwmAPBTronBid
- Analyst observation Recent confirmed account history contained successful TRX transfers and Energy delegation or undelegation operations.
- Analyst observation On-chain activity corroborates current resource operations but does not independently audit every displayed marketplace total or establish a verified real-world identity.
Public urlscan search returned no indexed result for the apex or www host. OTX returned zero threat pulses; its one apex URL observation recorded HTTP 200 and no Google Safe Browsing match. The current OpenPhish feed had no exact-domain entry, and exact public searches of ANY.RUN, Hybrid Analysis, Triage, URLQuery, and Joe Sandbox exposed no sample-level result. Public media results confirmed recent TronBid coverage, but several prominent items were press-release or promotional review content and were not treated as security validation.
- Public artifact URL https://urlscan.io/domain/tronbid.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/tronbid.com
- Analyst observation urlscan returned zero indexed scans for both the apex and www host, while OTX returned zero pulses and one ordinary apex URL observation.
- Analyst observation Exact public sandbox-index searches did not expose a current sample-level result. Public coverage is incomplete.
- Analyst observation Recent public media coverage exists, but press-release syndication and promotional reviews are not direct evidence of website security.
The public archive index contained 172 distinct successful apex or www HTML records from November 2013 through June 2019. A reviewed 2016 snapshot was a PrestaShop industrial-equipment store and the 2019 snapshot was a parking page. Public registration data records the current registration from March 3, 2026, and certificate history for the current registration begins later that month. The archived content therefore predates the present registration and does not establish either current operator continuity or a current malicious object.
- Public artifact URL https://web.archive.org/web/20160409200341id_/http://www.tronbid.com/
- Public artifact URL https://web.archive.org/web/20190608185224id_/http://tronbid.com/
- Page element Shop powered by PrestaShop
- Analyst observation The archive index contained 172 distinct successful HTML records from 2013 through 2019 and no capture from the current 2026 registration.
- DNS fact Public registration data records the current tronbid.com registration from 2026-03-03.
The current Terms and Privacy pages describe the TRON resource service, irreversible transactions, dynamic prices, no-refund default, wallet-address and usage data, support email, and Telegram contact. They state that TronBid does not request or store private keys. The same public policies do not identify a legal entity, registration number, physical business address, specific governing jurisdiction, or a detailed dispute and refund process. That is a concrete transparency weakness for an irreversible cryptocurrency-payment service, but it did not reproduce phishing, malware delivery, credential theft, or deceptive transaction construction.
- Public artifact URL https://tronbid.com/en/terms
- Public artifact URL https://tronbid.com/en/privacy
- Page element Blockchain transactions are irreversible
- Page element We DO NOT collect or store private keys
- Analyst observation The public policies provide support contacts but do not name a legal entity, registration number, physical business address, or specific governing jurisdiction.
No specific malware file, executable, archive, exploit, payload URL, payload hash, credential receiver, seed-phrase receiver, private-key receiver, unrelated redirect, or automatic harmful action was identified in the reviewed current scope. The appealed host is also the registrable parent domain, so exact-host and parent-domain checks refer to the same apex; www was reviewed as its redirecting alias. The prior warning was a domain classification without a reproduced current malicious object.
- Analyst observation No exact malware file, executable, archive, exploit, payload URL, payload hash, credential receiver, seed-phrase receiver, private-key receiver, or reproducible harmful action was identified.
Scope and limitations
- The appealed host is the registrable parent domain, so exact-host and parent-domain OSINT refer to the same tronbid.com apex. The www alias was reviewed separately.
- The review covered the current Gridinsoft report, DNS, TLS, HTTP redirects, all 90 sitemap objects, current same-origin client resources, public forms and API responses, representative marketplace records, three published TRON addresses, public URL and threat-intelligence indexes, media search, and archive history.
- No account was created, wallet was connected, challenge was signed, order was created, funds were sent, seller permission was changed, resource was delegated, withdrawal was requested, API key was used, or personal information was submitted.
- Application source review covered the current public client resources and their visible transaction construction. It did not inspect private backend source, infrastructure, databases, logs, wallets, signing keys, administrator accounts, or unpublished endpoints.
- Public marketplace totals are service-published data. Recent public blockchain activity corroborates ongoing transfers and delegations but does not independently audit every aggregate, order, user count, saving estimate, payment, or fulfillment claim.
- The public policies do not identify a legal entity, registration number, physical business address, specific governing jurisdiction, or detailed refund and dispute process. No independent legal, licensing, sanctions, accounting, custody, or regulatory-compliance assessment was performed.
- The current domain registration began in March 2026. Archive captures from 2013 through 2019 relate to an earlier registration period and cannot establish present operator continuity.
- Public index and search coverage is incomplete, and absence from an index does not prove that no unindexed event has ever occurred.
- Safe describes the current observed public deployment and reviewed flows. It is not a guarantee of future content, transaction performance, counterparty conduct, service solvency, legal compliance, or private server state.
Help protect others by sharing this page on social media! The more people who know about tronbid.com, the fewer chances they have to deceive someone else. Help others evaluate tronbid.com by sharing this page on social media!