# Flix Vision (flix.com.vision) APK Scraper Architecture Audit

**Audit date:** 2026-05-31  
**Source:** Decompiled `zyhpy9.apk` via jadx (12,475 source files)  
**App version:** ~v3.6.3r, package `flix.com.vision`

## Key APIs & Credentials

| Secret | Value |
|--------|-------|
| TMDB API Key | `2f3cb5763db1117fcba3948632f8aad9` |
| Trakt Client ID | `39c944040d5f19862b77e7a66b6c419af653c1e3bf226cc691eb2abbb551730c` |
| Backend Server | `http://185.112.144.240` (private IP) |

## Scraper Architecture — 4 Tiers

### Tier 1: Embed URLs (FLIXVISION1-5) — Always work, no debrid

| Label | Pattern |
|-------|---------|
| **FLIXVISION** | `http://185.112.144.240/ext/gotv.html?goto={tmdb_id}&s={season}&e={episode}` |
| **FLIXVISION2** | `https://embed.smashystream.com/playere.php?tmdb={id}` (+ season/episode for series) |
| **FLIXVISION3** | `https://autoembed.co/tv/tmdb/{id}-{season}-{episode}` (user-configurable `autoembed_url`) |
| **FLIXVISION4** | `https://vidsrc.me/embed/tv/{id}/{season}-{episode}` |
| **FLIXVISION5** | `https://vidsrc.xyz/embed/movie/{id}` |

### Tier 2: Direct Video Hoster Extractors (7 scrapers)

| Extractor | Domain | Technique |
|-----------|--------|-----------|
| GogoExtractor | `streamcool.pro` | Encrypted AJAX + AES-256-CBC crypto, JSoup parses `.list-server-items > .linkserver` |
| DoodExtractor | `doodstream.com` | Extracts `/pass_md5/` token from page, appends token to host URL |
| VidsrcExtractor | `vsembed.ru`, `9anime.eltik.net`, `vidstream.pro` | Multi-step API calls: episode ID → source ID → futoken → raw file via `9anime.eltik.net/fmovies-decrypt` |
| CloudnestraExtractor | `cloudnestra.com`, `vsembed.ru` | Scrapes iframe src, parses `<!--serversList-->` comments, extracts `src:` with variable interpolation (`{v1}`..`{v5}`) |
| FileMoonExtractor | `azm.to` | Unpacks packed JS (Hi/unpack function), parses `.setup()` JSON for sources array |
| CloseloadExtractor | `closeload.top/`, `ridomovies.tv/` | ROT13 + base64 brute-force + "unmixLoop" decryption on encoded video URLs |
| VixcloudExtractor | `vixcloud.co/` | JSoup `window.video` + `window.masterPlaylist`, language-aware HLS subtitle patching |

**Key lesson:** These break constantly. NOT worth copying. Hosters change encryption monthly.

### Tier 3: Movie Link Scrapers (Direct .mp4/.m3u8)

| Service | Base URL | Pattern |
|---------|----------|---------|
| AllMovieLand | `https://allmovieland.you/` | `/play/{imdb_id}` → returns playlist JSON |
| SwiftStreamz | `https://www.swiftstreamz.cc/SwiftStreamzv2.4/data.php` | Configurable host in SharedPrefs |
| ML Host (default) | `https://trinstor297undoint.com` | User-configurable, defaults to `/play/{imdb_id}` |

### Tier 4: Site-Specific Content Scrapers

| Source | API Base | Endpoints |
|--------|----------|-----------|
| HDO Box | Relative to `185.112.144.240` | `/ajax/movie_sources/{id}`, `/ajax/movie_embed/{id}`, `/ajax/v4_movie_episodes/{id}` |
| 123MoviesGo | Relative to configurable host | `/ajax/sources/{id}`, `/ajax/movie/episodes/{id}`, `/ajax/v2/episode/servers/{id}` |
| RidoMovies | Configurable | `api/search`, `api/show/{slug}/season/{number}` |
| Cartoon/FFMovies | Via `185.112.144.240` | `/ajax-get-link-stream/`, WordPress admin-ajax.php |
| TMDB (catalog) | `api.themoviedb.org/3/` | Standard TMDB API (trending, popular, search, discover, credits, etc.) |
| Trakt | `api.trakt.tv` | Trending, watchlist, collection, history, calendar, recommendations |

## Debrid Service Integration

| Service | Base URL | Auth |
|---------|----------|------|
| Real-Debrid | `api.real-debrid.com` | OAuth device code → Bearer token |
| AllDebrid | `api.alldebrid.com` | API key (agent: "flixvision") |
| Premiumize | `www.premiumize.me` | API key |

**220+ hosters supported** for debrid resolution (1fichier, mega, mediafire, rapidgator, streamtape, etc.).

## UI Assets Extracted

55 unique images at `/tmp/zyhpy9-images_unique/`:

**Service Logos (16):** netflix.png, prime.png, disney.png, hbomax.png, hulu.png, paramount.png, peacock.png, starz.png, appletvplus.png, discovery_logo.png, amc_image.png, cbs_image.png, brit_box.png, bet_plus_2.png, showtime_image.png, syfy_image.png

**Debrid Logos (4):** rd_logo.png, all_debrid.png, premiumize_icon.jpg, direct_stream_logo.png

**Utility (7):** tmdb_logo.png, trakt.png, imdb.png, vlc_icon.png, chromecast.png, settings.png, play.png

**Streaming Backdrops (16):** netflix_movie.jpg, disney_movie.jpg, hbo_movie.jpg, hulu_movie.jpg, prime_movie.jpg, etc.

## Key Architectural Differences from Unspooled/NuvioTV

| Aspect | Flix Vision | Unspooled |
|--------|-------------|-----------|
| Primary source model | Embed URLs + direct hoster scraping | Stremio addons → infoHashes → debrid |
| Content discovery | HDO Box, 123MoviesGo, RidoMovies + TMDB | TMDB via catalog system |
| Playback | WebView (embed) or direct .mp4/.m3u8 | ExoPlayer (direct URLs) |
| Backend | `185.112.144.240` (private IP) | Cloudflare Workers |
| Debrid role | Optional (resolves hoster links) | Required for most streams |
| Extractors | 7 fragile site-specific scrapers | None (config-driven addon pipeline) |