live · scanning repos
Scanrepo
github.com
github.com / xtekky

xtekky/TikTok-Viewbot

Python·28 files·commit 0073d8f·scanned 1h ago·cached ✓
25/100
LOW RISK
Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 25 — 1,910 stars — findings likely legitimate code patterns

verdict accurate?
threat-state: lowlive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.old/v1/to update/viewbot.py
    def gui(self):
        os.system("cls" if os.name == "nt" else "clear")
        txt = """\n██╗   ██╗██╗███████╗██╗    ██╗██████╗  ██████╗ ████████╗\n██║   ██║██║██╔════╝██║    ██║██╔══██╗██╔═══██╗...
+4
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.old/v1/viewbot.py

        if eval(base64.b64decode("dGhyZWFkaW5nLmFjdGl2ZV9jb3VudCgpIDwgMTAwICMgZG9uJ3QgY2hhbmdlIGNvdW50IG9yIHUgd2lsbCBraWxsIGRldmljZXMgYW5kIHJ1aW4gZnVuIGZvciBvdGhlcnM=")):
            did, iid, cdid, ...
+8
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.old/v1/viewbot.py

        if eval(base64.b64decode("dGhyZWFkaW5nLmFjdGl2ZV9jb3VudCgpIDwgMTAwICMgZG9uJ3QgY2hhbmdlIGNvdW50IG9yIHUgd2lsbCBraWxsIGRldmljZXMgYW5kIHJ1aW4gZnVuIGZvciBvdGhlcnM=")):
            did, iid, cdid, ...
+7
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.old/v1/viewbot.py
        while True:
            os.system(f'title TikTok Viewbot by @xtekky ^| success: {success} fails: {fails} reqs: {reqs} rps: {rps} rpm: {rpm}')
            time.sleep(0.1)
+4
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.test.py
    def main(self):
        os.system(self.clear)
        self.change_title("TikTok Automator using zefoy.com | Github: @xtekky")
+4
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.v2.py

        task, div = self.tasks[self.option][0]; eval(task)
               
        video_url_box = f'/html/body/div[{div}]/div/form/div/input'
+8
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.v2.py

        task, div = self.tasks[self.option][0]; eval(task)
               
        video_url_box = f'/html/body/div[{div}]/div/form/div/input'
+7
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
criticalPython base64 payload executionDecoding a base64 blob and passing it to exec()/compile() is a common obfuscation technique in Python malware.old/v1/viewbot.py

        if eval(base64.b64decode("dGhyZWFkaW5nLmFjdGl2ZV9jb3VudCgpIDwgMTAwICMgZG9uJ3QgY2hhbmdlIGNvdW50IG9yIHUgd2lsbCBraWxsIGRldmljZXMgYW5kIHJ1aW4gZnVuIGZvciBvdGhlcnM=")):
            did, iid, cdid, ...
+8
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.old/main.py+3
warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.old/v1/to update/mobile/mobile_script.py+3
warningHigh-entropy string literalsFound 7 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.old/v1/to update/viewbot.py+3
warningLarge base64-encoded blobA 132-character base64 blob was found. May hide a remote payload or encoded executable code.old/v1/viewbot.py
dGhyZWFkaW5nLmFjdGl2ZV9jb3VudCgpIDwgMTAwICMgZG9uJ3QgY2hhbmdl...
+3
warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.old/v2/main.py
553246736447566b58312f7a4f72413653425342717a6e4231596f7a4d59...
+3
warningLarge hex-encoded blobA 128-character hex blob was found. Often used to hide shellcode or C2 addresses.old/v2/main.py
553246736447566b58312f7a4f72413653425342717a6e4231596f7a4d59...
+3
warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.old/v2/test.py
553246736447566b58312f7a4f72413653425342717a6e4231596f7a4d59...
+3
warningLarge hex-encoded blobA 128-character hex blob was found. Often used to hide shellcode or C2 addresses.old/v2/test.py
553246736447566b58312f7a4f72413653425342717a6e4231596f7a4d59...
+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

17 files scanned @ 0073d8f | 9/25/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration0
file system access0
obfuscation15
supply chain0
owasp / injection0
telemetry
files 17/28rules hit 17engine v6commit 0073d8f

github

xtekky/TikTok-Viewbot

ViewBot using requests | Fast, no selenium | Custom Views count | Updated 2025

Python
1910
681
1545d
28 files
17 scanned(61%)
0073d8f

architecture░▒▓

entry (0) flagged (12) pkg (37)
51 nodes · 122 edgesscroll to zoom · click node to jump to finding