Free tool · Public research
Is your Android TV box on the research list? Look up its model, then follow a practical verification checklist.
A model name is a starting point.
Listed does not confirm infection. Unlisted does not establish safety.
Use the full model from Settings → About or the label on your TV box.
Search the research list, then use the verification checklist below. This page cannot scan your device.
The “MECOOL” brand prefix was omitted when comparing the model.
Local lookup · Your model input is not sent to a server or saved by this tool.
02 / Verify
Each check gives you more context.
None is a complete security assessment.
Open your box’s Settings → About (sometimes Device Preferences → About). Compare that name with the underside label and your purchase record.
Include suffixes such as PRO, MAX or PLUS. Record the firmware build too. A retail product name can differ from the model reported by Android.
A brand name or certification logo does not identify the firmware on your particular device.
anyevonline[.]commqtt.szbboys[.]comott.szbboys[.]comThe [.] notation means a dot. DNS logs show hostnames, not ports. A connection log may also show traffic to port 8000 or the reported MQTT ports 3885–3887. Source: Google ↗
If you already use Android Debug Bridge and have authorized a connection to your own box, these read-only commands display its reported model, build and installed package names:
adb shell getprop ro.product.model
adb shell getprop ro.build.display.id
adb shell pm list packages x.cpe
adb shell pm list packages com.oemservice
adb shell pm list packages com.abc.nexusLook for the exact output lines package:x.cpe, package:com.oemservice or package:com.abc.nexus; the command’s filter can also return longer names. These names are indicators described by Google, not a full malware test. Missing packages do not rule out other variants. An ADB connection or permission error means the check did not run.
Do not expose ADB to the internet. If you enabled debugging for this check, turn it off and revoke debugging authorizations afterward. This guide does not require rooting or changing firmware.
03 / Next steps
A disrupted botnet and a clean device
are different things to verify.
Check the full model, build and available logs. Keep a note of what you found and when. Share those details with the seller or manufacturer when asking about your specific firmware.
Our precautionary advice: disconnect a suspect box from the network while you investigate. Request a documented remedy or replacement from the seller. Blocking domains alone cannot establish that the device is clean.
The research list and your logs have limited coverage. Use official update channels, avoid unknown APKs, and consult the manufacturer if the firmware’s origin or support is unclear.
Do not assume a box is either repaired or unusable. Playback and connectivity can depend on the device and services. Google reports firmware persistence; taking control infrastructure offline does not demonstrate that the firmware has been removed.
The disconnect-and-contact-support steps above are aluo.app’s precautionary advice. Google’s report describes the backdoor and recommends trusted app stores, active Play Protect and reputable device manufacturers. It does not certify the result of this checker.
04 / Reference
182 model strings observed in the campaign by Synthient. Original spelling and case are preserved, including formatting variants. A name alone cannot confirm compromise.
10P10S4K_Android_TV_Box4K_Google_TV_Box4K_Google_TV_Stick8S90889P9SABSL-216ABSL-432ABSL_432AHD9000APLAY4Aurora-1GenB11BC13BLUECOM_TVBPTV30CBOX_3.0changshiCruze_Tv_HybridCruzetv_Hybrid_3_tunerDongleTV1DREAMSTAR_A4DREAMSTAR_B_SeriesDS4000E10E900V22Cext-4K Android TV BoxFAS_K2150GI_UNI2GLBox_HD500Gpon_Y4H616HC1HD801_4KHD890_4KhuayanI-905IK-R8-2ImpalaINTV-110INTV_1000INTV_ASISTIPx1IPx3iX-MACANK5K7KA1KA2KARAxKARAKD1KD2KD3KD5kh3KH3KH6kh9KII_PROKIII_PROKM1KM1_QM0202VKM2KM21KM22KM22_PROKM23KM2PLUSKM2PLUSDELUXEKM3KM6KM7KM7PLUSKM7SEKM7SE_GTVKM8KM8-ATV-MFKM9KM9PROKM9PRO_MAXKS3KT1KT2LEAP-S1Lite_3LunnM7.0M8S_PLUSM8S_PLUS_DVBM8S_PLUS_WM8S_PRO_WM8SPROWMagicPlusMAXIMUSMAXIMUS_5.0MAXIMUS_6.0mboxMbox_VFDMbox_Y4Mbox_Y4_T2MECOOLMEGA_PLUS_GOLDMeGo1MEgo1_2KMEgo1_4KMI_SmartMMC-B19MXV-4KMyBoxNEK7NetUP_v.3.1.NetUP_v.4.2.Nitro_X3NL5H00XNXMYOCBNONSCREEN_SparkOTT-5000PALFLIXPDB-F2Prime_1.0PROPRO-C2PRO-M2PRO02PulsePulse_Dropq3-evo-1Q96MAXQX1RL02rossRS02RT-X3RT-X3GBRT-X3KRT-X3SRT-X3VRW01S12_PLUS_GOLDS168S16_PLUS_GOLDS16PlusGoldS905SA01SHOWBOXShowBoxskycomSS-BOX1Steren_INTV_1000STV-3000_PlusSTV-3000PlusSTVB2SWITRON-i12LSXYJT10t7_an400TBox_TVTEH-500TEH-500_PLUSTeslaTK20_PROTV007TV008TV_Game_boxTV_StickTVCOMTW.ONETW.twoTX3MINIU10UHD_Google_TV_STBULTRA-LINKV1Vala_Plus_4VBSL-217WR-370yitaiZipSmart_PrimeCommon questions
No. It compares the text you enter with a public model-name list. It has no access to your box, network traffic, router logs or installed apps.
KM9PRO is one of the model strings in Synthient’s list. That establishes a model-name match only. Your device’s hardware revision, firmware and observed behavior still need checking.
Google reports that the backdoor can reinstall from the OEM firmware partition after a reboot. A package disappearing or a factory reset completing is not evidence that the underlying firmware is clean. Ask for a documented remedy for your exact build.
Model names can be reused, firmware varies, and the research list is not a complete inventory of all affected devices. The available information cannot support that conclusion.
Evidence & maintenance
This independent tool compares model names with public research. aluo.app is not affiliated with Google or Synthient and has not examined your device.
37354c9eb534 · source updated Nov 2, 2026This is a versioned snapshot, not a live feed. Model strings retain the source spelling and case. Formatting variants can refer to the same search key. Report a correction.