Is xmaza.tv safe?

encoded payload

suspicious base64-like blobs detected in page content

cloaking

Page checks user-agent for bot/crawler strings to serve different content

cloaking

Page conditionally redirects based on referrer or user-agent

js obfuscation

JavaScript uses Function constructor for runtime code generation

obfuscated code

A heavily obfuscated JavaScript block is embedded directly in the page HTML (inside a div.code-block with data-cfasync='false'). It uses a rotating array self-invoking pattern (while(!![]){try{...}catch(E){O['push'](O['shift']());}}) with all string literals replaced by hex-offset lookups via function R(). This technique is the canonical fingerprint of ad-injector/redirector malware that decodes and executes payload URLs at runtime, making static analysis impossible without execution. (location: page.html:280, page-text.txt:185 — <script data-cfasync='false'> inside <div class='code-block code-block-1'>)

malicious redirect

The obfuscated script block reconstructs strings that include 'proxy', 'adManager', 'static', and a date-derived subdomain segment, then dynamically injects a remote script tag. The assembled variable W maps to a pattern matching ad-proxy or tracker injection endpoints. The script is loaded lazily on user interaction (mousemove/scroll/touchstart) to evade automated scanners, a standard technique used by malvertising redirect chains. (location: page.html:280 — obfuscated <script data-cfasync='false'> block; page.html:89 — interaction-triggered GTM loader pattern)

brand impersonation

The page title, meta description, and article tags massively enumerate competitor brand names including 'ullu', 'aagmaal', 'xmaal', 'uncutmaza', 'xmasti', 'webxseries', 'hiwebxseries', 'fsiblog', 'rajwap', 'mydesi', 'desixflix' and dozens more. This spamdexing technique hijacks the brand recognition of legitimate platforms to lure users searching for those services, constituting brand impersonation for traffic diversion. (location: page.html:71-72 (title/meta), page.html:119 — article class tag attributes listing 80+ competitor brand tags)

hidden content

Each video article element has its class attribute stuffed with 80-100 SEO keyword tags (tag-aagmaal, tag-ullu, tag-rajwap, tag-mydesi, etc.) that are not rendered as visible text to users but are parsed by search engines and AI crawlers. This constitutes hidden keyword stuffing — content visible to bots but not to human users — used to manipulate indexing and agent context poisoning. (location: page.html:119, 127, 135, 143, 151 — data-* and class attributes on every <article> element)

credential harvesting

A login modal (id='wpst-user-modal') collects username and password fields and POSTs to https://xmaza.tv/ with a hidden action value 'wpst_login_member'. The site is an adult piracy platform with no legitimate reason to require user accounts; the login form is designed to harvest credentials which may be reused across other services. A nonce value is exposed in the page source (c2a6c2567c) and the wp-admin AJAX URL is disclosed. (location: page.html:292-293 — <form id='wpst_login_form'> with wpst_user_login and wpst_user_pass inputs; page.html:299 — wpst_ajax_var nonce disclosure)

social engineering

The site uses the 'Registration is disabled' message alongside prominent Login and Sign Up prompts to create urgency and imply exclusive access, a common social engineering pattern to encourage credential submission on untrustworthy platforms. (location: page.html:290 — 'Registration is disabled' alert adjacent to login form; page-text.txt:195-198)