Monkey D. Luffy Live Wallpaper New version

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

This extension claims to provide a One Piece live wallpaper for Chrome new tabs, but the evidence reveals behavior inconsistent with this purpose. The XIOC extractor identified 518 medium-severity domain findings including a.kz, б2.sr, yu.bt, b.cd, j9.cz, b.bw, b.no, vƚ.ge, ug.tt, dc5.cw, and j.im. These domains exhibit patterns typical of malicious infrastructure: random single-character subdomains, Cyrillic character substitution (б in б2.sr, ƚ in vƚ.ge), and top-level domains rarely used for legitimate services (.bt, .cd, .cw, .tt). A legitimate wallpaper extension would not require communication with hundreds of such domains.

The developer attribution is [email protected], a generic Gmail address with no identifiable company or organization. This anonymous publisher status combined with the suspicious domain patterns creates a high-risk profile. The 17 low-severity code-smell findings are noise per the CVEQ false-positive guidelines and do not contribute to the verdict.

Counterargument: A skeptic could argue the IoC findings are XIOC extractor false positives from bundled dependencies or minified code. However, these domains do not match known false-positive patterns. They are not legitimate infrastructure domains like googleapis.com or cloudflare.com, not IPv6 fragments like ::b or 6::, and not property access chains like b.call or h.next. The random character combinations and Cyrillic substitutions indicate intentional domain generation or obfuscation, not extraction errors. The volume of 518 unique suspicious domains far exceeds typical false-positive noise from bundled libraries.

Without malware signatures or network traffic analysis, definitive malicious intent cannot be confirmed. However, the combination of anonymous publishing, mismatched functionality, and 518 suspicious domain communications justifies a confirmed_risk verdict. Runtime analysis would clarify whether these domains are used for ad injection, data exfiltration, or command-and-control.

Key Reasons

• 518 suspicious domain IoCs with random character patterns and Cyrillic substitution
• Anonymous developer using generic Gmail address
• Extension functionality (wallpaper) inconsistent with network behavior
• No malware signatures but high-risk domain patterns present
• No legitimate CDN or infrastructure domains in IoC list

False Positive Considerations

• XIOC extractor noise
• Code-smell low-severity findings

Reviewed 2026-04-28; recommended action: runtime analysis; model confidence 75%.