Analysis of Fox Kitten Infrastructure Reveals Unique Host Patterns and Potentially New IOCs

Censys reviewed the joint FBI/CISA/DC3 advisory on Iran-based Fox Kitten, examined the historical and current profiles of 17 IOCs (12 IPs and 5 domains), and found distinctive, recurring patterns across hosts, ASNs, geolocations, ports, software fingerprints, and certificates. Using those patterns, Censys identified additional active hosts and 64 valid self-signed/Let’s Encrypt certificates that may be part of the same infrastructure, observed IOC activity outside the advisory timeframes, and recommended defenders add newly identified IPs and certificates to watchlists or blocklists.