Itachi Uchiha Crimson Eye Live Wallpaper

AI Security Review

Evidence context: threat category pup; evidence quality moderate.

What the findings show

The extension is named Itachi Uchiha Crimson Eye Live Wallpaper, and its description says it replaces Chrome's new tab with a live HD video wallpaper. The metadata provides only the Gmail address [email protected] as the developer, with no company or product identity recorded alongside XIOC-DOMAIN-1m.kn in extracted_from_files. The extension declares no permissions or host permissions, which limits direct access to browser data according to the permission metadata associated with XIOC-DOMAIN-1m.kn.

The network list contains short, unusual domains such as 1m.kn, 2h.gi, 2t.pl, 9b.cr, bb.cg, bg.mp, bu.bf, cao.cx, cb.mr, ce.support, and custom.show. The extracted indicators include XIOC-DOMAIN-1m.kn, XIOC-DOMAIN-y4.ng, XIOC-DOMAIN-o.at, XIOC-DOMAIN-g.pn, XIOC-DOMAIN-o.ne, XIOC-DOMAIN-2t.pl, XIOC-DOMAIN-9b.cr, XIOC-DOMAIN-ev.bb, XIOC-DOMAIN-l.pn, XIOC-DOMAIN-ɨ.lt, XIOC-DOMAIN-nc.mz, and XIOC-DOMAIN-a.kr, each located at extracted_from_files. Those indicators are specific enough to deserve attention because they do not identify a recognizable wallpaper provider, media CDN, or established developer service.

The available findings do not establish credential theft, browser hijacking, or malware delivery. No malware signature, malware, network-behavior, or obfuscation finding is listed with XIOC-DOMAIN-1m.kn, and the extension has no declared permissions beside the empty permission metadata associated with that finding. The endpoint list also lacks a search template or a banking, payment, or login target in the supplied material, so a hijacking or credential-theft category would overstate the evidence.

Counterargument

A skeptic could say the short domains are extractor artifacts. That concern is valid for XIOC-DOMAIN-ɨ.lt and similar two-part indicators in extracted_from_files, since short strings can be mistaken for domains in bundled or minified content. The concern does not resolve the separate endpoint list containing 1m.kn, 2t.pl, 9b.cr, and custom.show, nor does it explain why a wallpaper extension from [email protected] needs so many unrelated-looking destinations. The supplied material lacks request timing, URL paths, response data, and the source file that creates each request. Runtime inspection should determine whether these domains serve wallpaper assets, advertising, telemetry, redirects, or unrelated content.

The safest current reading is an unverified new-tab personalization extension with weak publisher attribution and unexplained external destinations. The absence of permissions and malware matches lowers the demonstrated impact, while the endpoint pattern prevents a clean benign assessment. Runtime analysis of custom.show, 1m.kn, and the other listed domains can separate content delivery from unwanted redirects or tracking.

Key Reasons

• XIOC-DOMAIN-1m.kn and XIOC-DOMAIN-2t.pl identify unusual external domains in extracted_from_files.
• The endpoint list includes 1m.kn, 2t.pl, 9b.cr, and custom.show, with no stated service purpose.
• The developer identity is limited to [email protected], alongside XIOC-DOMAIN-1m.kn.
• No malware signature or obfuscation finding is associated with XIOC-DOMAIN-1m.kn.
• The extension declares no permissions or host permissions, according to the metadata associated with XIOC-DOMAIN-1m.kn.

False Positive Considerations

• Short domain-like strings in extracted_from_files can be IoC extractor artifacts, including XIOC-DOMAIN-ɨ.lt.
• The XIOC titles identify strings in extracted_from_files, without request paths or runtime evidence showing that each domain is contacted.
• No malware signature or obfuscation finding accompanies XIOC-DOMAIN-1m.kn.

Reviewed 2026-09-29; recommended action: runtime analysis; model confidence 68%.