What Gridinsoft observed on hydraflix.cc
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260904062911-4ba5bcbe
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
Suspicious Website remains supported by current source evidence of advertising-popup attempts in the still-selectable VidZen player. Missing iframe sandboxing alone is not the basis. This is not a finding of malware distribution or phishing.
Analyst findings
Review 3 documented observations View evidence
The apex led to the www site. The reviewed watch page still offered seven third-party players, including VidZen. Their iframe sandbox settings were disabled. VidPi and Embed 2 displayed source instructions rejecting sandboxed playback; absence of sandboxing alone is not evidence of malware.
-
HTTP status
200 - Public artifact URL https://www.hydraflix.cc/watch/movie/671/harry-potter-and-the-philosopher-s-stone/
- Page element MoviesAPI, VidLove, VidCore, NTG, VidPi, VidZen, Embed 2
Two current VidZen responses contained the same document-wide click handler calling window.open for an advertising URL, with a 10-second cooldown. This is source evidence of attempted popup navigation; a successful browser popup or the final advertising destination was not tested.
-
HTTP status
200 - Public artifact URL https://vidzen.fun/movie/671
-
Redirect destination
https://www.effectivecpmnetwork.com/umamtpuj27
The other six configured player URLs returned HTTP 200. MoviesAPI contained window.open wrapper code, NTG loaded an advertising-selection script, and the Hydraflix watch page included an al5sm.com advertising tag. These integrations require separate behavior checks; their presence alone does not prove malware.
- Public artifact URL https://moviesapi.vip/movie/671
- Public artifact URL https://www.nontongo.win/assets/playerad-ntg.js
- Public artifact URL https://al5sm.com/tag.min.js
Scope and limitations
- The review inspected current HTTP responses and source code; it did not execute player interactions, visit final advertising destinations, or download unknown files.
- The reviewed movie flow is a sample. Other titles, dynamic advertising decisions, browser popup blocking, and subsequent site changes were not exhaustively assessed.
- No specific malware file, payload, exploit, credential receiver, or automatic download was identified. Removing one integration is not a certification of every remaining player.
