# Investigating IPTV Malware in the Wild
## 4 Findings  
This experiment completed for evaluating the IITMAF entailed submitting a research sample of illegal IPTV technology URLs to the IITMAF and comparing the analysis results with results from VirusTotal. The research sample had a total of 60 URLs consisting of 35 illicit IPTV website URLs, 13 app store URLs (from 7 app stores), and 12 standalone software executable and add-on URLs. Less illicit IPTV app store and software URLs were included in the research sample, as they were more difficult to locate in comparison to websites, which are more accessible using search engines.  
For this evaluation (Section 3.3), each sample URL submitted to the IITMAF collected up to 25 URLs, which were then submitted for analysis in addition to the research sample URL. Once the analysis reports had been generated for the research sample, the number of URLs in the research sample identified as malicious was recorded and compared with the results of the research sample URLs submitted to VirusTotal (Table 1). Moreover, the number of URLs in the research sample that scraped URLs or files identified as malicious by the IITMAF was recorded. These results were then compared with the number of URLs in the research sample that identified malicious-related files from 2022 for the domain of the URLs in VirusTotal. Only malicious files from 2022 were used to determine the number of malicious relations for a URL, as VirusTotal is a community-based threat intelligence platform that identifies malware previously submitted that may not be relevant to URLs in 2022. Hence, only recent malware from 2022 was counted.  
Table 1 presents the findings of the experiment completed to evaluate the IITMAF software solution, which was conducted from the 8 th to the 16 th of August 2022. As VirusTotal identifies related malicious files with a URL domain, we used the domains of the URLs in the research sample to determine whether a URL had related malicious files. Therefore, the related malicious file results for app stores are out of seven, as the thirteen app store URLs in the research sample only include seven different domains.  
The experiment results show that the IITMAF solution detected more URLs as malicious than VirusTotal overall, with the IITMAF identifying 32 out of the 60 URLs of the research sample as malicious, while VirusTotal only identified 23 as malicious. Additionally, the IITMAF solution detected related malicious files or URLs for 31 of the research sample URLs, whereas VirusTotal identified 26 malicious relations from 2022.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline
**IPTV Technology** & **IPTV Website** & **IPTV App Store** & \multicolumn{2}{c}{**IPTV Software**} \\  & & & & & **Executable** \\ \hline Research sample size & \multirow{2}{*}{35} & \multirow{2}{*}{13} & \multirow{2}{*}{12} \\ Solution & IITMAF & VirusTotal & IITMAF & VirusTotal & IITMAF & VirusTotal \\ \hline Files or URLs & & & & & \\ identified as malicious in the research sample & \multirow{2}{*}{27} & \multirow{2}{*}{10} & \multirow{2}{*}{1} & \multirow{2}{*}{6} & \multirow{2}{*}{4} & \multirow{2}{*}{7} \\ Related files or & & & & & \\ URLs & & & & & & \\ extracted from the research sample URLs & \multirow{2}{*}{20} & \multirow{2}{*}{12} & \multirow{2}{*}{3 (out of 7 different app store domains)} & \multirow{2}{*}{8} & \multirow{2}{*}{6} \\ identified as malicious & & & & & \\ \hline \end{tabular}
\end{table}
Table 1: Experiment results of malicious illicit IPTV URLs and files.