Deadpool Swimming Pool Live Wallpaper New Tab

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

Security Analysis: Deadpool Swimming Pool Live Wallpaper New Tab

This Chrome extension presents significant adware risk through its network behavior and domain infrastructure. The extension declares itself as a "Swimming Pool Live Wallpaper for your Chrome new tab," yet the evidence reveals infrastructure inconsistent with legitimate wallpaper functionality.

Suspicious Domain Infrastructure

The XIOC extractor identified 685 domains, including uw.ir, m.sb, 6.tk, d.au, u.gr, s.gn, q.as, r.fm, v.tw, and e.md. These are NOT benign false-positive patterns like Google CDNs, IPv6 fragments, or property access chains. These are short, random-looking domains from various TLDs (Iran, Seychelles, Tokelau, Australia, Greece, Guinea) commonly associated with ad networks, redirect services, or tracking infrastructure. A legitimate wallpaper extension does not require contact with 685 different domains.

Network Activity

Network findings show fetch calls in js/script.js:45 and js/popup.js:29. Combined with the 685 IoC domains, this indicates the extension is actively communicating with external servers beyond what a static wallpaper extension should do. The file paths show these are in the main JavaScript files, not bundled dependencies.

Anonymous Publisher

The developer is listed as [email protected] - a generic Gmail address with no company attribution. This is a red flag for extensions in the browser hijack/adware category, where legitimate publishers typically use company domains.

Counterargument and Rebuttal

A skeptic might argue the 685 IoC count could include legitimate content delivery or analytics domains. However, the specific domains listed (6.tk, m.sb, uw.ir) are not standard CDN or analytics providers. Additionally, there are zero malware signatures and zero obfuscation findings, which might suggest benign intent. Yet the combination of anonymous publisher, massive suspicious domain count, and network fetch calls in core files outweighs the absence of malware signatures. Adware often doesn't trigger malware signatures while still posing significant privacy and security risks through tracking and unwanted redirects.

Recommendation

This extension should be flagged for potential adware behavior. Users should be warned about the extensive network communication and anonymous publisher before installation.

Key Reasons

• 685 suspicious domain IoCs inconsistent with wallpaper functionality
• Network fetch calls in js/script.js and js/popup.js
• Anonymous developer (Gmail address, no company)
• Short random TLD domains (6.tk, m.sb, uw.ir) typical of ad networks
• No malware signatures but adware infrastructure present

False Positive Considerations

• code-smell findings (35 low-severity rules)
• high IoC count from ad network domains

Reviewed 2026-05-08; recommended action: monitor; model confidence 75%.