Frequently asked questions

IPTV middleware: a management panel plus an HTTP API that resellers use to provision subscribers. The API became a de facto standard, so almost every modern player speaks it natively even though the original product is long gone.

Authentication model. Xtream uses a credential pair sent as query parameters on every request. Stalker registers hardware MAC addresses and maps them to subscriber profiles, so no password exists in the exchange at all.

No session. Username and password are re-sent on every call. Stalker does issue a token after a handshake, but Xtream has nothing equivalent.

Because it is part of the origin, and panels are rarely on port 80 — 8080, 8000 and 25461 are all common. Drop the port and every request goes somewhere that is not the panel.

Mixed-content policy. An HTTPS page cannot request a plain HTTP host, and panels almost never present a valid certificate, so a Worker performs the request and reports back.

The XMLTV endpoint is optional and expensive to serve. Many panels never populate it and many rate-limit it hard. It carries no signal about whether streams work.

Only up to the account connection limit, which the player API reports alongside the active count. Exceeding it lets authentication succeed while streams refuse to open.

It is the OUI of the original MAG hardware. Portals often validate the prefix, because anything outside that range is unlikely to be a genuine set-top box.

No. The dataset is parsed in your browser and rows are selected on your device. There is no backend recording any of it.

Email us with the specifics and the entry goes. Rights-holder requests are actioned the same day wherever possible.