Kimwolf Botnet IoCs

mttaggart · January 5, 2026, 4:26pm

main

# Kimwolf

## Observables

### Domains & IPs

| Indicator | ASN | Organization | Context |
| :--- | :--- | :--- | :--- |
| 62[.]210[.]172[.]157:443 | AS12876 | Scaleway Dedibox | Kimwolf C2 Server (Dec 25th) |
| 80[.]75[.]212[.]10:80 | AS49581 | Ferdinand Zink trading as Tube-Hosting | Kimwolf Proxy Gateway (RESITO) |
| 85[.]234[.]91[.]247:1337 | AS59437 | G-Core Labs S.A. | Kimwolf Command & Control (Latest) |
| 87[.]120[.]167[.]80:6666 | AS199524 | G-Core Labs S.A. | Kimwolf Payload Delivery (Dec 27th) |
| 89[.]39[.]70[.]110:443 | AS199524 | G-Core Labs S.A. | Kimwolf Post-Install Script Download |
| 93[.]95[.]112[.]53:5099 | AS397923 | W3S holding BV | Kimwolf Binary Download (mreo12) |
| 93[.]95[.]112[.]53:8443 | AS397923 | W3S holding BV | Kimwolf Payload/C2 Server (Dec 1st) |
| 93[.]95[.]112[.]53:1003 | AS397923 | W3S holding BV | Kimwolf Binary Download (mreo11) |
| 93[.]95[.]112[.]53:3582 | AS397923 | W3S holding BV | Kimwolf Binary Download (meow57.apk) |
| 93[.]95[.]112[.]53:8082 | AS397923 | W3S holding BV | Kimwolf Binary Download (mreo11.apk) |
| 95[.]133[.]243[.]159:443 | AS204044 | PACKET STAR NETWORKS LIMITED | Kimwolf C2 Server (Dec 14th) |
| 104[.]243[.]41[.]110:80 | AS23470 | ReliableSite.Net LLC | Kimwolf Proxy Gateway (RESITO) |

This file has been truncated. show original

Check yourself at https://synthient.com

I’ll add these to MISP.

mttaggart · January 5, 2026, 5:58pm

Added to MISP: f81d9e1b-4327-4239-a094-55069ed824bc