Spider-Man Basketball Live Wallpaper

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

The extension "Spider-Man Basketball Live Wallpaper" claims to transform the new tab page with dynamic wallpapers, but its network behavior contradicts this stated purpose. The IoC findings reveal connections to domains including 4ah1g.gp, 2.es, 0i1ܕ.ar, l.tj, o1y.cr, b.fj, 4g.dk, ѯ.sa, djn.ws, z.ng, zm.id, and p.rs. These domains share concerning characteristics: short random subdomains, obscure country-code TLDs, and some contain non-ASCII characters (the Arabic character in 0i1ܕ.ar, the Greek character in ѯ.sa). None of these domains are legitimate CDN or infrastructure providers like googleapis.com, gstatic.com, or cloudflare.com.

The extension has 0 users and is published under an email address ([email protected]) rather than a verified developer name or organization. While the findings summary shows 572 IoC detections and 35 code-smell findings, these counts alone are not determinative. The critical issue is the nature of the specific domains detected, not the volume of findings. A legitimate wallpaper extension would not require network connections to random domains across .gp, .es, .ar, .tj, .cr, .fj, .dk, .sa, .ws, .ng, .id, and .rs TLDs.

The absence of malware signatures (0 malware-signature findings, 0 malware findings) and obfuscation (0 obfuscation findings) prevents a confirmed_malicious verdict. However, the mismatch between stated functionality (wallpaper display) and actual behavior (network communication to suspicious domains) is a classic browser hijacking pattern. The extension may be serving monetized content, redirecting searches, or exfiltrating browsing data under the guise of a harmless wallpaper tool.

Counterargument: A skeptic might argue the 572 IoC findings are largely false positives from the XIOC extractor or bundled dependencies, and the code-smell findings are noise from YARA rules that fire on any non-trivial JavaScript. This is partially valid—the finding count is inflated by known FP patterns. However, the specific domain names themselves are not false positives. Domains like 4ah1g.gp and o1y.cr are real, suspicious domains that warrant investigation regardless of how many total IoCs were detected. The domain pattern (short random strings on obscure TLDs) is consistent with known browser hijacker infrastructure, not legitimate services. This specific evidence outweighs the general noise in the finding counts.

Key Reasons

• Network connections to suspicious domains (4ah1g.gp, 2.es, 0i1ܕ.ar, etc.) inconsistent with wallpaper functionality
• Zero user count with anonymous developer email ([email protected])
• Multiple domains with non-ASCII characters and obscure country-code TLDs
• No malware signatures detected, preventing confirmed_malicious verdict

False Positive Considerations

• XIOC extractor generates high-volume domain detections from minified code
• Code-smell findings (35 low-severity) from generic YARA rules
• Finding count inflation from bundled dependencies

Reviewed 2026-04-27; recommended action: escalate; model confidence 75%.