Luna Adblock for Youtube & Websites

AI Security Review

Evidence context: threat category adware; evidence quality strong.

Security Analysis: Luna Adblock for Youtube & Websites

This extension demonstrates strong indicators of malicious behavior through malware signature matches and suspicious domain communications that deviate from legitimate ad blocker patterns.

Malware Signatures: The extension triggered 153 high-severity malware signature findings according to the findings_summary. These are distinct from code-smell findings (which are all 0 in the by_category breakdown). Malware signatures represent specific known malicious patterns, not generic code quality warnings. The absence of any code-smell findings means these are not false positives from overly broad rules like Bolonyokte or JavaDropper.

Suspicious Domain Communications: The IoC findings reveal five specific domains that are not typical ad network infrastructure: fpapi.io, g12281228770.co, fptls3.com, fptls4.com, and fran.pro. Legitimate ad blockers reference known advertising domains (doubleclick.net, googleadservices.com, etc.) in their filter lists. These domains instead exhibit patterns consistent with command-and-control infrastructure: g12281228770.co contains embedded numeric sequences common in malware C2 domains, while fptls3.com and fptls4.com suggest TLS-based communication channels. The domain fran.pro lacks any legitimate business presence.

Network Activity: Network findings show fetch calls in content-scripts/youtube-cosmetic.js:4, youtube-bootstrap.js:77, and content-scripts/universal-adblock.js:7. While ad blockers legitimately fetch filter lists, these calls combined with the suspicious domains indicate potential data exfiltration or remote configuration.

Anonymous Publisher: The developer_name field is empty, which is a red flag for an extension with 726 users. Legitimate ad blockers from known publishers (uBlock Origin, AdGuard) always have identifiable developers.

Counterargument: A skeptic might argue that the 12,031 IoC findings are from bundled adblock filter lists, which legitimately contain thousands of domains. This is a valid concern for ad blockers. However, the specific domains extracted (g12281228770.co, fptls3.com) do not match known ad networks or filter list patterns. Additionally, the 153 malware signatures are separate from IoC findings and represent actual malware pattern matches, not generic code-smell. The combination of malware signatures with non-ad-network domains and anonymous publication outweighs the filter list explanation.

Recommendation: This extension should be removed from the Firefox store. The evidence indicates adware or data exfiltration behavior disguised as an ad blocker.

Key Reasons

• 153 high-severity malware signature findings (not code-smell)
• Suspicious domains (g12281228770.co, fptls3.com, fptls4.com) not matching legitimate ad networks
• Anonymous developer with 726 users
• Network fetch calls combined with suspicious IoC domains
• Extension behavior inconsistent with stated ad-blocking purpose

Reviewed 2026-04-27; recommended action: escalate; model confidence 85%.