The following domains were observed while investigating dual-function Chrome browser extensions with malware indicators. 

The investigation can be found at https://dti.domaintools.com/dual-function-malware-chrome-extensions/

Lure Websites


debank-extension[.]world
debank[.]sbs
debank[.]click
earthvpn[.]top
addetective[.]world
manusai[.]sbs
spylens[.]world
youtube-vision[.]com
iron-tunnel[.]com
amlsector[.]com
cookie-whitelist[.]com
crypto-whale[.]info
deepseek-ai[.]link
calendlydaily[.]world
calendlydocker[.]com
cryptowhalesvision[.]world
creativehunter[.]world
creativepeek[.]world
irontunnel[.]world
squirrel-wallet[.]world
aml-sector[.]world
adelephant[.]world
madgicxads[.]world
siteanalyzer[.]world
webinsight[.]world
calendly-director[.]com
ad-scope[.]world
whale-alerts[.]org
x-theme[.]world
webwatch[.]world
sitestats[.]world
ad-vision[.]top
ad-spy[.]world
youtube-vision[.]world
analytics-box[.]world
web-metrics[.]link
ad-eye[.]help
meta-spy365[.]com
crypto-whale[.]top
web-analytics[.]top
ad-vision[.]click
madgicx-plus[.]com
similar-net[.]com
meta-spy[.]help
meta-guests[.]com
ad-seeker[.]world
privacy-shield[.]world
ad-guardian[.]world
safesurf[.]world
raccoon-vpn[.]world
orchid-vpn[.]com
whale-alert[.]life
flight-radar[.]life
adtwin[.]world
soul-vpn[.]com
twin-web[.]world
forti-vpn[.]com
fortivnp[.]com
wti-analytics[.]com
workfront-plus[.]com
eventphere[.]com
lockads[.]org
wtigroups[.]com


API Domains

wobblefizz[.]top
zingleflap[.]top
floopdoodle[.]top
wibblywob[.]top
snickerdoodle[.]top
wobbleguff[.]top
sprocketwhirl[.]top
jumblefizz[.]top
quirkleblip[.]top
twizzleflap[.]top
fizzlepopcorn[.]top
glimmerbloop[.]top
noodlequack[.]top
jibberjot[.]top
blurflewhack[.]top
snogglewomp[.]top
flibberwump[.]top
quizzlepuff[.]top
digigtalneo[.]top
digigtalwow[.]top
spaceball[.]top
iochange[.]top
iospace[.]top
ioapp[.]sbs
iohub[.]sbs
ioonline[.]top
e-xt[.]top
infonet[.]sbs
datazen[.]sbs
datavibe[.]sbs
infosync[.]top
infograph[.]top
zorpleflux[.]top