Ben Brundage installed IP Idea's software on an old Android phone via a pirated streaming app and monitored all traffic coming in and out. Within a week, a mysterious domain appeared: xd.resi.to — the direct link KimWolf was using to break into devices on the network.