Goku Ultra Instinct Master Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The extension "Goku Ultra Instinct Master Live Wallpaper" presents significant security concerns based on its indicator of compromise (IoC) findings. The analysis reveals 772 domain IoCs extracted from the extension's files, including suspicious domains such as m.cz, n.pm, vx.ae, 7.cu, cz.ki, ރk7.it, x.sc, m-.ba, xn.ci, j.gw, sr.bt, and 7.yt. These domains do not correspond to legitimate infrastructure like CDNs (googleapis.com, gstatic.com), analytics services, or the extension's own service.

The domain patterns themselves are highly suspicious. Single-letter subdomains (m.cz, n.pm, x.sc), numeric prefixes (7.cu, 7.yt), and Unicode characters (ރk7.it containing the Dhivehi letter ރ) are characteristic of ad networks, redirect services, or command-and-control infrastructure rather than legitimate wallpaper functionality. The extension's stated purpose of displaying anime wallpapers does not explain why it would need to connect to 772 external domains. The finding XIOC-DOMAIN-ރk7.it is particularly notable as it contains a non-Latin script character, which is unusual for legitimate infrastructure domains.

The developer identity adds to the concern. The extension is published by [email protected], a generic Gmail address with no verified publisher status. Combined with zero users, this suggests either a brand new extension or one that has been removed from mainstream distribution. The version 4.4.3 suggests some iteration history, but the zero user count indicates minimal adoption.

The 16 code-smell findings (low severity) are typical noise from YARA rules matching basic JavaScript patterns and should not drive the verdict. The absence of malware signatures and obfuscation findings is notable, but this does not rule out PUP/adware behavior. Browser hijackers often do not trigger malware signatures because they rely on domain connections rather than executable payloads.

The strongest counterargument is that the IoC extractor produces false positives. However, these domains do not match known false-positive patterns: they are not IPv6 fragments (::, ::b, 6::), not CDN/infrastructure domains (googleapis.com, gstatic.com, cloudflare.com), not property access chains (b.call, h.next, g.id), and not generic infrastructure. The domain names are genuinely suspicious and warrant investigation. If these were false positives, they would match the documented patterns from the XIOC extractor, which they do not.

Runtime analysis is recommended to determine if these domains are actively contacted during extension operation. If the extension actively connects to these domains, it should be classified as browser hijacking or adware. The combination of suspicious IoCs, anonymous publisher, and zero users creates a risk profile that exceeds typical false-positive patterns.

Key Reasons

• 772 suspicious domain IoCs with non-standard TLDs (m.cz, n.pm, 7.cu, 7.yt)
• Anonymous Gmail publisher ([email protected])
• Zero user count indicating minimal adoption
• Extension purpose does not explain 772 external domain connections
• Domain patterns match ad network/redirect infrastructure

Reviewed 2026-04-27; recommended action: runtime analysis; model confidence 75%.