---
title: Hunt: find XCPE-backdoored Android TV boxes on your network by their HTTP bootstrap and MQTT check-ins to anyevonline.com and szbboys.com | ctxsec
url: https://ctxsec.com/items/hunt-xcpe-android-tv-box-backdoor-network-indicators
description: "Google's XCPE report gives network indicators that work well in DNS and proxy logs even after the takedown, because infected boxes keep trying to reach the seized domains. Look for lookups of mcstb.anyevonline.com or stb*.anyevonline.com on port 8000, mqtt.szbboys.com, and ott.szbboys.com, plus HTTP POSTs to /router/config/mqtt, /router/config/acs and /router/config/app. Any hit is a device to pull off the network."
status: "official (indicators from Google Threat Intelligence Group's Nov 2 report); domains were seized, so hits mean an infected device is still trying to call home"
published: 2026-11-02
---

> Google's XCPE report gives network indicators that work well in DNS and proxy logs even after the takedown, because infected boxes keep trying to reach the seized domains. Look for lookups of mcstb.anyevonline.com or stb*.anyevonline.com on port 8000, mqtt.szbboys.com, and ott.szbboys.com, plus HTTP POSTs to /router/config/mqtt, /router/config/acs and /router/config/app. Any hit is a device to pull off the network.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-xcpe-android-tv-box-backdoor-network-indicators.md)

official (indicators from Google Threat Intelligence Group's Nov 2 report); domains were seized, so hits mean an infected device is still trying to call home

2026-11-02

### Hunt: find XCPE-backdoored Android TV boxes on your network by their HTTP bootstrap and MQTT check-ins to anyevonline.com and szbboys.com

From Google Threat Intelligence Group's **Nov 2** analysis of the XCPE firmware backdoor:

- **HTTP bootstrap:** `http://mcstb.anyevonline[.]com:8000` on MECOOL devices (system property `ro.mecool.device`), otherwise `http://stb[AndroidVersion][Type].anyevonline[.]com:8000`. The device POSTs AES-encrypted hardware telemetry (serial, MAC, model, firmware) to `/router/config/mqtt`, `/router/config/acs` and `/router/config/app`.
- **MQTT C2:** every sample Google analyzed used `mqtt.szbboys[.]com`, topics shaped like `/device/{model}/{chipId}/{action}`.
- **Upload endpoint:** `http://ott.szbboys[.]com:8000/cpe/file/upload`.
- **Other tells:** lookups of `ip-api[.]com` and a Google STUN server from a TV box right after boot; module files pulled from operator-owned GitHub release pages.
- **On the device** (if you can get adb access): packages `x.cpe`, `com.oemservice`, `com.abc.nexus`, content providers `com.release.debug.provider` and `com.oem.share.provider`, and the global setting `package_verifier_user_consent` set to `-1` (Play Protect verification turned off).

**Hunt ideas:** search DNS and proxy logs for `*.anyevonline.com` and `*.szbboys.com`; flag outbound TCP 1883/8883 (MQTT) or HTTP to port 8000 from IoT or guest VLANs; and look for consumer media devices acting as proxy exit nodes (many unrelated inbound-initiated or long-lived outbound sessions). Because the domains are now seized, a hit tells you a box is infected, not that it is still controlled; the backdoor can be re-pointed, so remove the device rather than just blocking the domains.

Sources: [Google Threat Intelligence Group: Shutting the Door on the XCPE Botnet (Nov 2)](https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/) · [Plume: XCPE botnet whitepaper](https://www.plume.com/xcpe-botnet-whitepaper-pdf)