Gojo Satoru Blindfold Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

The extension "Gojo Satoru Removes his blindfold live wallpaper" exhibits significant risk indicators centered on 460 IoC findings for suspicious domains. The domains detected (ja.sx, 2.sd, 9.do, ma.bh, 3.ax, za.gi, n.py, n.kn, 3.aw, 4.tj, s.sx, m-4ϟ.bd) are not legitimate infrastructure domains and do not match known false-positive patterns like CDN domains, property access chains, or IPv6 fragments.

A live wallpaper extension has no legitimate need to contact 460 different domains. These domains exhibit characteristics of adware monetization infrastructure: short, random-looking strings with uncommon TLDs (.sx, .sd, .do, .bh, .ax, .gi, .py, .kn, .aw, .tj). The developer attribution ([email protected]) is an email address rather than a verified company name, which is common in low-quality or malicious extensions.

The absence of malware signatures does not indicate safety. Adware and PUPs often avoid traditional malware detection by using legitimate techniques (HTTP requests, redirects) rather than executing malicious code. The 19 code-smell findings are low-severity noise consistent with standard JavaScript patterns and do not drive this verdict.

Counterargument: A skeptic might argue these domains could be from bundled dependencies or a content delivery network for wallpaper images. This is implausible because 460 domains is excessive for any legitimate use case, the domains are random-looking strings rather than typical CDN infrastructure (which would use domains like cdn.example.com, gstatic.com, or cloudflare.com), and the extension type (wallpaper) does not require contact with hundreds of different domains. The file paths show "extracted_from_files" indicating these domains are in the extension's actual code, not just dist/ bundles.

Conclusion: The evidence indicates adware/PUP behavior with significant user risk from potential ad injection, redirects, or data exfiltration. Runtime analysis would confirm actual behavior, but the domain pattern alone warrants a confirmed_risk verdict.

Key Reasons

• 460 suspicious domain IoCs (ja.sx, 2.sd, 9.do, etc.) inconsistent with wallpaper functionality
• Domains use uncommon TLDs and random naming patterns typical of adware infrastructure
• Developer is unverified email address ([email protected]) rather than company name
• Extension type does not justify hundreds of external domain connections

False Positive Considerations

• None of the known FP patterns apply - these are not CDN domains, property access chains, or IPv6 fragments

Reviewed 2026-04-30; recommended action: escalate; model confidence 82%.