{"id":1247,"date":"2026-02-11T17:04:30","date_gmt":"2026-02-11T17:04:30","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/"},"modified":"2026-02-11T17:04:30","modified_gmt":"2026-02-11T17:04:30","slug":"kimwolf-botnet-swamps-anonymity-network-i2p","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/","title":{"rendered":"Kimwolf Botnet Swamps Anonymity Network I2P"},"content":{"rendered":"
\n

For the past week, the massive \u201cInternet of Things\u201d (IoT) botnet known as Kimwolf<\/strong> has been disrupting The Invisible Internet Project<\/strong> (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade takedown attempts against the botnet\u2019s control servers.<\/p>\n

Kimwolf is a botnet that surfaced in late 2025 and quickly infected millions of systems, turning poorly secured IoT devices like TV streaming boxes, digital picture frames and routers into relays for malicious traffic and abnormally large<\/a> distributed denial-of-service (DDoS) attacks.<\/p>\n

I2P is a decentralized, privacy-focused network that allows people to communicate and share information anonymously.<\/p>\n

\u201cIt works by routing data through multiple encrypted layers across volunteer-operated nodes, hiding both the sender\u2019s and receiver\u2019s locations,\u201d the I2P website explains<\/a>. \u201cThe result is a secure, censorship-resistant network designed for private websites, messaging, and data sharing.\u201d<\/p>\n

On February 3, I2P users began complaining on the organization\u2019s GitHub page<\/a> about tens of thousands of routers suddenly overwhelming the network, preventing existing users from communicating with legitimate nodes. Users reported a rapidly increasing number of new routers joining the network that were unable to transmit data, and that the mass influx of new systems had overwhelmed the network to the point where users could no longer connect.<\/p>\n

\"\"<\/p>\n

I2P users complaining about service disruptions from a rapidly increasing number of routers suddenly swamping the network.<\/p>\n<\/div>\n

When one I2P user asked whether the network was under attack, another user replied, \u201cLooks like it. My physical router freezes when the number of connections exceeds 60,000.\u201d<\/p>\n

\"\"<\/p>\n

A graph shared by I2P developers showing a marked drop in successful connections on the I2P network around the time the Kimwolf botnet started trying to use the network for fallback communications.<\/p>\n<\/div>\n

The same day that I2P users began noticing the outages, the individuals in control of Kimwolf<\/a> posted to their Discord channel that they had accidentally disrupted I2P after attempting to join 700,000 Kimwolf-infected bots as nodes on the network.<\/p>\n

\"\"<\/p>\n

The Kimwolf botmaster openly discusses what they are doing with the botnet in a Discord channel with my name on it.<\/p>\n<\/div>\n

Although Kimwolf is known as a potent weapon for launching DDoS attacks, the outages caused this week by some portion of the botnet attempting to join I2P are what\u2019s known as a \u201cSybil attack<\/a>,\u201d a threat in peer-to-peer networks where a single entity can disrupt the system by creating, controlling, and operating a large number of fake, pseudonymous identities.<\/span><\/p>\n

Indeed, the number of Kimwolf-infected routers that tried to join I2P this past week was many times the network\u2019s normal size. I2P\u2019s Wikipedia page<\/a> says the network consists of roughly 55,000 computers distributed throughout the world, with each participant acting as both a router (to relay traffic) and a client.<\/p>\n

However, Lance James<\/strong>, founder of the New York City based cybersecurity consultancy Unit 221B<\/a> and the original founder of I2P, told KrebsOnSecurity the entire I2P network now consists of between 15,000 and 20,000 devices on any given day.<\/p>\n

\"\"<\/p>\n

An I2P user posted this graph on Feb. 10, showing tens of thousands of routers \u2014 mostly from the United States \u2014 suddenly attempting to join the network.<\/p>\n<\/div>\n

Benjamin Brundage<\/strong> is founder of Synthient<\/a>, a startup that tracks proxy services and was the first to document Kimwolf\u2019s unique spreading techniques<\/a>. Brundage said the Kimwolf operator(s) have been trying to build a command and control network that can\u2019t easily be taken down by security companies and network operators that are working together to combat the spread of the botnet.<\/p>\n

Brundage said the people in control of Kimwolf have been experimenting with using I2P and a similar anonymity network \u2014 Tor<\/a> \u2014 as a backup command and control network, although there have been no reports of widespread disruptions in the Tor network recently.<\/p>\n

\u201cI don\u2019t think their goal is to take I2P down,\u201d he said. \u201cIt\u2019s more they\u2019re looking for an alternative to keep the botnet stable in the face of takedown attempts.\u201d<\/p>\n

The Kimwolf botnet created challenges for Cloudflare late last year when it began instructing millions of infected devices to use Cloudflare\u2019s domain name system (DNS) settings, causing control domains associated with Kimwolf\u00a0to repeatedly usurp <\/a>Amazon<\/strong>,\u00a0Apple<\/strong>,\u00a0Google<\/strong>\u00a0and\u00a0Microsoft<\/strong> in Cloudflare\u2019s public ranking of the most frequently requested websites.<\/p>\n

James said the I2P network is still operating at about half of its normal capacity, and that a new release is rolling out which should bring some stability improvements over the next week for users.<\/p>\n

Meanwhile, Brundage said the good news is Kimwolf\u2019s overlords appear to have quite recently alienated some of their more competent developers and operators, leading to a rookie mistake this past week that caused the botnet\u2019s overall numbers to drop by more than 600,000 infected systems.<\/p>\n

\u201cIt seems like they\u2019re just testing stuff, like running experiments in production,\u201d he said. \u201cBut the botnet\u2019s numbers are dropping significantly now, and they don\u2019t seem to know what they\u2019re doing.\u201d<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

For the past week, the massive \u201cInternet of Things\u201d (IoT) botnet known as Kimwolf has been disrupting The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[113,411,90,483,348,641,360,642,643,368,644,645],"tags":[91],"class_list":["post-1247","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-benjamin-brundage","category-cybersecurity","category-ddos","category-ddos-for-hire","category-i2p","category-kimwolf-botnet","category-lance-james","category-sybil-attack","category-synthient","category-tor","category-unit-221b","tag-cybersecurity"],"yoast_head":"\nKimwolf Botnet Swamps Anonymity Network I2P - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kimwolf Botnet Swamps Anonymity Network I2P - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"For the past week, the massive \u201cInternet of Things\u201d (IoT) botnet known as Kimwolf has been disrupting The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-11T17:04:30+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Kimwolf Botnet Swamps Anonymity Network I2P\",\"datePublished\":\"2026-02-11T17:04:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\"},\"wordCount\":866,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"A Little Sunshine\",\"Benjamin Brundage\",\"Cybersecurity\",\"DDoS\",\"DDoS-for-Hire\",\"I2P\",\"Kimwolf botnet\",\"Lance James\",\"Sybil attack\",\"Synthient\",\"Tor\",\"Unit 221B\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\",\"name\":\"Kimwolf Botnet Swamps Anonymity Network I2P - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png\",\"datePublished\":\"2026-02-11T17:04:30+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kimwolf Botnet Swamps Anonymity Network I2P\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Kimwolf Botnet Swamps Anonymity Network I2P - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/","og_locale":"en_US","og_type":"article","og_title":"Kimwolf Botnet Swamps Anonymity Network I2P - Imperative Business Ventures Limited","og_description":"For the past week, the massive \u201cInternet of Things\u201d (IoT) botnet known as Kimwolf has been disrupting The Invisible Internet Project (I2P), a decentralized, encrypted communications network designed to anonymize and secure online communications. I2P users started reporting disruptions in the network around the same time the Kimwolf botmasters began relying on it to evade […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-02-11T17:04:30+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Kimwolf Botnet Swamps Anonymity Network I2P","datePublished":"2026-02-11T17:04:30+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/"},"wordCount":866,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png","keywords":["Cybersecurity"],"articleSection":["A Little Sunshine","Benjamin Brundage","Cybersecurity","DDoS","DDoS-for-Hire","I2P","Kimwolf botnet","Lance James","Sybil attack","Synthient","Tor","Unit 221B"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/","name":"Kimwolf Botnet Swamps Anonymity Network I2P - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png","datePublished":"2026-02-11T17:04:30+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/02\/i2p-github.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/02\/11\/kimwolf-botnet-swamps-anonymity-network-i2p\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Kimwolf Botnet Swamps Anonymity Network I2P"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/1247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=1247"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/1247\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=1247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=1247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=1247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}