I was not looking for this. I was just doing routine traffic analysis on my own home network, something I do as part of learning packet analysis more deeply, when one device caught my attention for a reason that had nothing to do with an alert going off. Nothing alerted. Nothing flagged. I noticed it because a projector was communicating with the internet in a way that felt off.
Here is what I found, and why it matters if you or anyone you know owns a cheap projector bought off Amazon.
The Projector That Would Not Stop Calling Home
The device in question is a mini portable 4K WiFi projector, sold under the AODIN brand, model X1BQ, the kind of budget projector you see all over Amazon for forty to eighty dollars with a home theater photo and a bunch of five-star reviews. Mine worked exactly as advertised. It streamed video perfectly, connected fine, gave me zero reason to suspect anything.
But while I was watching raw packet captures, one detail stood out. The projector was sending a DNS request to a domain called o.fecebbbk, spelled to look like Facebook’s mobile domain at a glance, but it is not Facebook; it is a lookalike domain built to fool anyone skimming logs. And it was doing this every single time, almost exactly 65 seconds apart, which is not something a human-generated app does. That kind of clockwork timing only comes from a program running on a timer.
What That Timer Turned Out To Be
Following that thread led to confirming the device was infected with something called Vo1d, a botnet malware that has been quietly spreading through Android-based smart TVs and streaming boxes for over a year now. By early 2025, researchers at Forbes reported more than 1.5 million infected devices tracked across over 200 countries, and the malware has grown into one of the most widespread Android botnets ever observed since it first appeared in late 2024. According to Germany’s federal cybersecurity agency, once active, it allows an attacker to install additional malware on the device and is currently being used to build a criminal proxy network and to run automated ad-click fraud.
What that actually means, in plain terms, is that if your device is infected, criminals can route their own internet traffic through your home connection without you knowing. Your IP address is what shows up if anyone traces that traffic back, not theirs. On top of that, the device can be used silently to fake ad clicks and views for ad fraud schemes, again using your bandwidth and connection to do so.
I confirmed this was not a false alarm using two independent tools. VirusTotal flagged the domain the projector was communicating with as malicious, and a threat intelligence lookup rated the command-and-control server behind it as high risk. I also ran a port scan on the device and found over a dozen open ports in a very specific range that matches known Vo1d infection patterns, the kind of port fingerprint that does not show up on a legitimate, uninfected device.
Here Is the Part That Should Actually Worry You
This device ran on my network, actively monitored by real enterprise-grade security tools, for more than two months before I caught it manually. Nothing automated flagged it. Not because those tools are bad, but because this specific malicious domain was not yet in any threat database, and nothing about the traffic pattern matched a known signature yet. The only reason I caught it was noticing something that felt slightly off and deciding to actually look closer instead of assuming everything was fine.
That is the uncomfortable truth about a lot of cheap connected devices these days. This was not something the manufacturer warned about; it was not something a virus scan on your phone or computer would ever catch, because the infection lives on the projector itself, not on any device you would normally think to check.
What You Should Actually Do
If you own this specific projector, the AODIN X1BQ, model listed on Amazon under ASIN B0DGX51JPC, I would unplug it and stop using it. I have already reported the listing to Amazon and filed a complaint with the FBI’s Internet Crime Complaint Center, since factory-level malware infection on a consumer product sold through a major retailer is exactly the kind of thing that needs to be on record somewhere official.
If you own a different cheap, no-name streaming device or projector, you likely cannot detect this yourself the way I did; that took specific tools and specific knowledge most people do not have and should not need to have just to safely own a projector. What you can reasonably do is be cautious about buying ultra-cheap, unbranded smart devices in general, especially anything running Android that came from a seller you cannot easily verify, and if you notice unexplained spikes in your internet usage or unfamiliar devices showing up in your router’s connected device list, that is worth taking seriously rather than shrugging off.
I put the full technical write-up, including the port scan results, the malicious domain, and the actual evidence, up on GitHub for anyone in security who wants to verify or build on this. You do not need to understand any of that to take the basic lesson here seriously: cheap connected devices can arrive compromised straight out of the box, and the only real defense right now is being skeptical of what you plug into your network in the first place.
Full technical disclosure: github.com/JohnyMetellus/aodin-vo1d-malware