PAPERWEREWOLF

Overview 93 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 11 reports

Ranked by how many of this actor's indicators each report brought in.

• 66bi.zone/eng/expertise/blog/kamen-nozhnitsy-buma…
• 66virustotal.com/gui/ip-address/193.233.18.135/relations
• 66virustotal.com/gui/ip-address/213.165.61.226/relations
• 66virustotal.com/gui/ip-address/78.153.149.182/relations
• 66virustotal.com/gui/ip-address/87.251.66.114/relations
• 66virustotal.com/gui/file/938dac6227e47fed245ad25d289489…
• 19intezer.com/blog/tracing-a-paper-werewolf-campaign-…
• 10x.com/phatomcandle/status/2083976136669974980

Timeline 93 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-08-02 9 domainthis year

   x.com/phatomcandle/status/2083976136669974980 · virustotal.com/gui/ip-address/130.49.213.54/relations · virustotal.com/gui/ip-address/213.165.61.50/relations · virustotal.com/gui/ip-address/77.110.112.165/relations

   acrobatupdate.online

   adobecheck.online

   certcheck.online

   certinform.online

   edgeupdates.online

   packetswift.online

   phan.club

   slimer.club

   xss.place

   copy batch

2. 2026-08-02 1 domainthis year

   bi.zone/eng/expertise/blog/kamen-nozhnitsy-buma… · virustotal.com/gui/ip-address/193.233.18.135/relations · virustotal.com/gui/ip-address/213.165.61.226/relations · virustotal.com/gui/ip-address/78.153.149.182/relations · virustotal.com/gui/ip-address/87.251.66.114/relations · virustotal.com/gui/file/938dac6227e47fed245ad25d289489… · x.com/phatomcandle/status/2083976136669974980 · virustotal.com/gui/ip-address/130.49.213.54/relations · virustotal.com/gui/ip-address/213.165.61.50/relations · virustotal.com/gui/ip-address/77.110.112.165/relations

   sslntp.online

   copy batch

3. 2026-05-17 60 domain, 4 urlthis year

   bi.zone/eng/expertise/blog/kamen-nozhnitsy-buma… · virustotal.com/gui/ip-address/193.233.18.135/relations · virustotal.com/gui/ip-address/213.165.61.226/relations · virustotal.com/gui/ip-address/78.153.149.182/relations · virustotal.com/gui/ip-address/87.251.66.114/relations · virustotal.com/gui/file/938dac6227e47fed245ad25d289489…

   domain	arrotech.org
   domain	certcalc.online
   domain	ntpadjust.online
   domain	ntpbayhai.online
   domain	ntpcalc.online
   domain	ntpchck.online
   domain	ntpcheck.online
   domain	ntpcorrect.online
   domain	ntpedge.online
   domain	ntpfetch.online
   domain	ntpfix.online
   domain	ntpget.online
   domain	ntphaiba.online
   domain	ntphaimot.online
   domain	ntphaisau.online
   domain	ntpinform.online
   domain	ntpluck.online
   domain	ntpmatch.online
   domain	ntpmuoitam.online
   domain	ntpnet.online
   domain	ntpquirks.online
   domain	ntpsetup.online
   domain	ntpsum.online
   domain	ntptake.online
   domain	ntptop.online
   domain	ntptrack.online
   domain	ntpverify.online
   domain	ntpzone.online
   domain	packetflow.online
   domain	packethost.online
   domain	packetlabs.online
   domain	packetread.online
   domain	packetsign.online
   domain	packettake.online
   domain	packetuser.online
   domain	packetxhub.online
   domain	sslchck.online
   domain	sslcom.online
   domain	sslfix.online
   domain	sslhttp.online
   domain	sslpack.online
   domain	sslpoll.online
   domain	sslradio.online
   domain	sslreach.online
   domain	sslserve.online
   domain	sslsign.online
   domain	sslstart.online
   domain	sslsum.online
   domain	ssltail.online
   domain	sslteam.online
   domain	ssltech.online
   domain	ssltick.online
   domain	ssltop.online
   domain	ssltrade.online
   domain	ssltrick.online
   domain	ssltun.online
   domain	sslvalid.online
   domain	updatestop.online
   domain	woburneast.com
   domain	zeccecard.com
   url	http://193.233.18.135
   url	http://213.165.61.226
   url	http://78.153.149.182
   url	http://87.251.66.114

   copy batch

4. 2026-05-17 1 domainthis year

   intezer.com/blog/tracing-a-paper-werewolf-campaign-… · bi.zone/eng/expertise/blog/kamen-nozhnitsy-buma… · virustotal.com/gui/ip-address/193.233.18.135/relations · virustotal.com/gui/ip-address/213.165.61.226/relations · virustotal.com/gui/ip-address/78.153.149.182/relations · virustotal.com/gui/ip-address/87.251.66.114/relations · virustotal.com/gui/file/938dac6227e47fed245ad25d289489…

   ntpsync.online

   copy batch

5. 2026-01-02 or earlier 18 domainthis year

   intezer.com/blog/tracing-a-paper-werewolf-campaign-…

   awalitalk.com

   easytrns.com

   fast-eda.my

   fastchessplay.com

   fungaros.com

   hakyru.com

   jantyroza.com

   ruzede.com

   timealign.online

   timebits.online

   timecheck.site

   timefetch.online

   timeget.cloud

   timeget.online

   timemaster.site

   timematch.online

   timemirror.online

   timesync.cloud

   copy batch

Further reading 11

• virustotal.com/gui/ip-address/87.251.66.114/relations
• virustotal.com/gui/ip-address/78.153.149.182/relations
• intezer.com/blog/tracing-a-paper-werewolf-campaign-…
• virustotal.com/gui/ip-address/193.233.18.135/relations
• virustotal.com/gui/ip-address/213.165.61.50/relations
• x.com/phatomcandle/status/2083976136669974980
• virustotal.com/gui/ip-address/213.165.61.226/relations
• virustotal.com/gui/ip-address/130.49.213.54/relations
• bi.zone/eng/expertise/blog/kamen-nozhnitsy-buma…
• virustotal.com/gui/ip-address/77.110.112.165/relations
• virustotal.com/gui/file/938dac6227e47fed245ad25d289489…