Synthient

@GossiTheDog@cyberplace.social These where not included in our observables list for a reason. That being said they needed to be included in the report because proxy providers read what we put out, and these IPs are absolutely important indicators for them.

https://github.com/synthient/public-research/blob/main/2026/01/kimwolf/README.md

@GossiTheDog@cyberplace.social
@wav3@infosec.exchange
We purchased 3 devices, 2 of which have been removed from Amazon. This one should have a proxy SDK installed though. If you are trying to get a Kimwolf sample that might be more challenging considering IPIDEA patched the vulnerability after we disclosed it.
https://www.amazon.com/dp/B0CCP23PWM