Known malicious kitmediumotherCommunity hunt

ARTEX console and rebranded interfaces

Created by the ScanMalware community
family: artex

Tracks exposed consoles of ARTEX, an LLM-driven autonomous penetration-testing system, and rebranded copies of it such as LUCK, 观澜SEC and ScopeWeaver. It matches the console's own titles (Chinese, English, Japanese and Korean), its favicon, the structure of its code (which stays the same across new builds and rebranded copies) and the community hunting rule vis_artex_console_auth, and also consoles hidden behind a password prompt named "ARTEX Gateway" or "ARTEX", recognised by that prompt's name in the server's response, or behind an access-password page whose server names itself artex-authd. A match identifies the software, not necessarily malicious use: the same console is run by red teams and by intruders.

Anchors

SMQL queryrun
title:"自主渗透测试控制台" OR title:"Autonomous Penetration Testing Console" OR title:"Autonomous Security Testing Console" OR title:"自律型ペネトレーションテスト管理画面" OR title:"自主资产控制台" OR title:"观澜SEC渗透测试平台" OR title:"Agent Security Workbench" OR title:"AegisLoop" OR title:"자율 침투 테스트 콘솔" OR favicon_hash:-576220750 OR (fp_canonical:07c0ba77f501a8d91900a7dcf6ab155a5fb0f330cd58c496cebddb81c89bffcf AND fp_canonical:2e0a1db71e351657fb1b47ebcd246d71c948e9ecb6f7d55b1324c0788e30ec2a AND fp_canonical:7af84493be6aa0d46928e1c08178a24a9efe1287b47d2cd9fde1070b0886fa41) OR fp_canonical:cc0d8622e6f3b04bdddc7c501d32b67b05dc20cefadcdc26c899510b2552c76a OR community_rule:vis_artex_console_auth OR ids_signature:"ARTEX agentic pentest console" OR server:"artex-authd"

Provenance

Added: 2026-10-31 17:09
Consoles are commonly exposed as artex.<IP>.sslip[.]io or nip[.]io names with their own certificate, as subdomains of other domains, or directly on ports 8787 and 18787. A host name starting with artex. is not proof on its own: one such host served an unrelated application. Confirm unauthorized use before treating a sighting as hostile. Some operators put the console behind a password prompt named "ARTEX Gateway" (seen on nginx, on Caddy and behind Cloudflare) or, in public reporting, "ARTEX"; such a host shows an empty page, so only the prompt identifies it. Others answer every address with their own access-password page, served by a server that names itself artex-authd; such a host shows only that page, so only the server name identifies it.

Community hunting rule

Every public scan this rule matches is a sighting of this hunt.

  • vis_artex_console_auth
    otherActive271 public matches
    Community hunting rule, submitted by the ScanMalware community

    Detects ARTEX console authentication code and rebranded variants

    Rule details

Sightings (306)Atom feed

Showing the 200 most recently scanned.

HostScanScriptMatchScanned
149.104.23.856822ba51…—query2026-11-04 08:25
140.238.214.810dc90057…—query2026-11-04 08:25
140.238.214.81a567e69a…—query2026-11-04 08:25
124.70.215.1672dd8c35a…—query2026-11-04 08:22
124.222.167.2037f063e66…—query2026-11-04 08:21
119.29.35.143c3053bb1…—query2026-11-04 08:20
124.221.46.5915959f69…—query2026-11-04 07:26
122.51.248.17061443650…—query2026-11-04 07:24
119.29.35.1431e3073bf…—query2026-11-04 07:21
119.29.35.143e7661f7d…—query2026-11-04 07:21
119.28.158.8327fe5161…—query2026-11-04 07:21
111.230.224.145d378b80f…—query2026-11-04 07:20
116.198.252.23890bf86b3…—query2026-11-04 06:25
114.66.17.1729260b0dd…—query2026-11-04 06:24
114.134.184.2472da45a41…—query2026-11-04 06:23
114.116.237.145ccb9481e…—query2026-11-04 06:23
112.111.53.21018b5226…—query2026-11-04 06:22
109.206.245.2038cbdec1…—query2026-11-04 06:20
107.173.254.7bcda4b7d…—query2026-11-04 05:26
106.52.83.14441342ae9…—query2026-11-04 05:22
104.250.149.21048cad27d…—query2026-11-04 05:22
103.30.78.179262a7e81…—query2026-11-04 04:24
103.116.247.423e3331f8…—query2026-11-04 04:24
101.43.199.25213bdc7e7…—query2026-11-04 04:23
101.42.4.91300b23bd…—query2026-11-04 04:23
101.32.162.1352a596bc1…—query2026-11-04 04:21
1.15.150.11484339e83…—query2026-11-04 04:20
166.0.22.233c5e5d833…—query2026-11-04 01:56
23.140.244.52ef644345…—query2026-11-04 01:55
43.131.232.249ce77fd2…—query2026-11-04 01:54
64.118.151.226c67c0f76…—query2026-11-04 01:52
207.56.26.232a8f35aec…—query2026-11-04 01:48
149.104.23.851a20339c…—query2026-11-04 01:47
202.79.168.1452f1bb49…—query2026-11-04 01:41
47.109.179.46f101c758…—query2026-11-04 01:41
52.128.238.9810bb5783…—query2026-11-04 01:39
8.140.228.202d18507a6…—query2026-11-04 01:31
202.79.168.6693bcba14…—query2026-11-04 01:27
117.55.226.23772d3bc19…—query2026-11-04 01:26
198.44.51.43f165e44b…—query2026-11-04 01:20
134.122.152.202a55a0c97…—query2026-11-04 01:18
163.7.14.164f6ef2480…—query2026-11-04 01:18
65.75.211.151eb628afe…—query2026-11-04 01:15
189.24.72.210421575f5…—query2026-11-04 01:11
93.152.214.134538b4ca3…—query2026-11-04 01:10
107.150.7.662cb07ce7…—query2026-11-04 01:06
43.138.147.253d7f998f9…—query2026-11-04 01:03
130.94.59.21448dbc904…—query2026-11-04 01:02
20.89.228.2172c093909…—query2026-11-04 01:01
189.24.72.210da65dcdc…—query2026-11-04 01:00
204.194.51.18756a35ac4…—query2026-11-04 00:52
45.205.31.131b5594911…—query2026-11-04 00:51
15.204.123.61baacad5b…—query2026-11-04 00:49
141.147.103.3174f8d77d…—query2026-11-04 00:45
156.233.230.1732a0aae7c…—query2026-11-04 00:32
204.12.234.10775f42784…—query2026-11-04 00:27
101.96.235.184c22d6a4f…—query2026-11-04 00:10
45.11.57.791672582a…—query2026-11-04 00:02
62.234.156.208fc78ad83…—query2026-11-03 23:56
45.205.31.131039861f1…—query2026-11-03 23:52
158.220.107.65a348016f…—query2026-11-03 23:46
168.93.199.186e0b8f1de…—query2026-11-03 23:41
192.238.245.122e610a809…—query2026-11-03 23:35
154.36.188.1330770b03e…—query2026-11-03 23:34
204.0.57.164fc7d6dcb…—query2026-11-03 23:31
39.108.48.114a90b94e…—query2026-11-03 23:29
152.53.53.142eb2f3d01…—query2026-11-03 23:24
154.94.226.26d24fad4b…—query2026-11-03 23:20
152.53.129.174186db59e…—query2026-11-03 23:12
47.254.125.123c3616071…—query2026-11-03 23:08
202.79.168.268b2500f8…—query2026-11-03 23:07
23.136.172.1639e7cb99c…—query2026-11-03 23:05
107.172.15.18061916546…—query2026-11-03 22:55
47.94.132.198d77d254e…—query2026-11-03 22:50
106.52.83.14467241f7b…—query2026-11-03 22:36
62.83.72.151306c6676…—query2026-11-03 22:33
158.247.253.149d40da922…—query2026-11-03 22:30
112.213.123.38e3c65388…—query2026-11-03 22:24
35.220.204.57329abff9…—query2026-11-03 22:15
43.160.223.25036152a6f…—query2026-11-03 22:07
138.2.16.55d6400b02…—query2026-11-03 22:05
216.250.255.90f57b033…—query2026-11-03 22:00
103.117.136.187101e3682…—query2026-11-03 21:58
112.213.123.388d6a3032…—query2026-11-03 21:56
162.251.92.367f2f3b5b…—query2026-11-03 21:51
52.128.244.6618f93291…—query2026-11-03 21:49
111.229.191.222ce359394…—query2026-11-03 21:39
204.12.234.108b463d44c…—query2026-11-03 21:35
111.228.25.143bf827103…—query2026-11-03 21:18
168.93.199.230c09e3c24…—query2026-11-03 21:16
154.36.188.133e777a047…—query2026-11-03 21:16
114.66.17.172725b5955…—query2026-11-03 21:02
106.75.239.78a887b90a…—query2026-11-03 21:00
106.14.113.8780fad217…—query2026-11-03 20:48
38.76.190.1852ccf151c…—query2026-11-03 20:45
43.231.0.1659922143c…—query2026-11-03 20:43
47.254.214.8703dcf8bf…—query2026-11-03 20:40
204.12.234.1106b4e7715…—query2026-11-03 20:32
5.104.86.10880cd6181…—query2026-11-03 20:31
204.194.51.54c1d24e3a…—query2026-11-03 20:30
140.143.171.119bcab2154…—query2026-11-03 20:27
45.77.24.715d6a6712…—query2026-11-03 20:21
154.94.226.2604aa90a6…—query2026-11-03 20:15
134.122.163.240b6689b0c…—query2026-11-03 20:11
204.0.57.1640b5f9a37…—query2026-11-03 20:08
186.241.76.23554bda193…—query2026-11-03 20:06
189.105.68.19054dd8ed9…—query2026-11-03 20:05
185.139.214.1565871e0ef…—query2026-11-03 19:59
69.12.91.694130cedc…—query2026-11-03 19:59
64.20.61.134a650083e…—query2026-11-03 19:52
106.55.34.199275f96c1…—query2026-11-03 19:51
158.158.114.97d9c81b45…—query2026-11-03 19:50
85.137.243.13873538b68…—query2026-11-03 19:48
8.136.28.108b8b2c9f0…—query2026-11-03 19:42
52.128.238.984170d746…—query2026-11-03 19:41
217.142.243.156073a9319…—query2026-11-03 19:40
35.220.204.57d816070a…—query2026-11-03 19:38
204.12.234.109dfaf49a2…—query2026-11-03 19:35
115.28.131.7398e339a8…—query2026-11-03 19:34
43.139.209.2191ddd5a8a…—query2026-11-03 19:31
38.76.167.2421c172bf5…—query2026-11-03 19:30
202.79.168.500bd63004…—query2026-11-03 19:26
20.89.228.217af0c72a8…—query2026-11-03 19:25
43.133.47.87542035b6…—query2026-11-03 19:24
150.158.46.75aa812413…—query2026-11-03 19:20
117.72.206.105885cbe3c…—query2026-11-03 19:16
223.223.219.30510ab307…—query2026-11-03 19:13
168.138.176.20508e87e5d…—query2026-11-03 19:11
103.240.198.1811c72efa0…—query2026-11-03 19:09
8.137.86.647f28747e…—query2026-11-03 19:05
149.104.30.17968d38fa…—query2026-11-03 19:01
204.194.51.1878cab721f…—query2026-11-03 18:53
124.220.102.768599e0d4…—query2026-11-03 18:49
52.253.119.229b26c65df…—query2026-11-03 18:46
124.221.210.109986feea4…—query2026-11-03 18:45
211.154.22.69eb4c0717…—query2026-11-03 18:44
130.94.20.888a33e5f5…—query2026-11-03 18:43
47.98.100.2777031d3d…—query2026-11-03 18:41
217.142.243.156de79d50d…—query2026-11-03 18:40
144.202.75.159c676650e…—query2026-11-03 18:37
38.76.186.166b6fefc6c…—query2026-11-03 18:37
45.205.18.161685a5241…—query2026-11-03 18:34
38.11.56.655a4b87f3…—query2026-11-03 18:32
167.17.74.3d9c78231…—query2026-11-03 18:30
154.12.86.20700992e79…—query2026-11-03 18:24
207.148.75.75c0adedfc…—query2026-11-03 18:22
104.250.149.2120a5ea332…—query2026-11-03 18:19
38.55.131.18663eea425…—query2026-11-03 18:12
162.35.29.60e403030…—query2026-11-03 18:10
161.118.218.114a96182f3…—query2026-11-03 18:08
154.222.19.167e07b1f03…—query2026-11-03 18:03
85.137.243.138b808d717…—query2026-11-03 17:58
113.20.0.1374c91001c…—query2026-11-03 17:37
189.105.68.1902e2ae37c…—query2026-11-03 17:36
69.12.91.692a67368b…—query2026-11-03 17:33
106.52.119.731d4aa149…—query2026-11-03 17:29
38.76.202.246dab9f834…—query2026-11-03 17:22
45.153.34.71418a3005…—query2026-11-03 17:14
117.72.206.1052a3d3ae2…—query2026-11-03 17:13
185.139.214.15635240809…—query2026-11-03 17:13
158.220.107.65ec0a8d2e…—query2026-11-03 17:12
124.222.192.14828af6876…—query2026-11-03 17:09
210.56.49.22293b5d671…—query2026-11-03 17:06
216.23.81.132fb1b4769…—query2026-11-03 17:02
40.81.203.59c088f9da…—query2026-11-03 16:58
155.103.157.435f13a7b1…—query2026-11-03 16:56
162.251.92.366b876161…—query2026-11-03 16:54
104.250.149.21240520cc8…—query2026-11-03 16:49
115.120.198.1653ef60df5…—query2026-11-03 16:39
165.154.236.195c27546d6…—query2026-11-03 16:34
168.138.176.2055970e1c3…—query2026-11-03 16:34
158.247.253.1494b0b760d…—query2026-11-03 16:26
112.213.123.3850086fe2…—query2026-11-03 16:24
82.158.89.116d9b4aab…—query2026-11-03 16:24
180.178.51.17007839f1e…—query2026-11-03 16:21
103.117.136.1874153910b…—query2026-11-03 16:19
38.55.145.112d8ffb23a…—query2026-11-03 16:15
38.76.167.2423b56b717…—query2026-11-03 16:15
47.98.177.14368e49aa0…—query2026-11-03 16:12
43.129.177.350ca60ac3…—query2026-11-03 16:09
43.138.139.9418b3cf22…—query2026-11-03 16:05
43.167.177.1783060b5a6…—query2026-11-03 16:03
8.131.74.8748c6990c…—query2026-11-03 15:59
39.98.58.69d0d51220…—query2026-11-03 15:59
175.41.25.2508f89ec25…—query2026-11-03 15:52
166.0.112.830b065480…—query2026-11-03 15:48
38.76.215.87f0b8b4a2…—query2026-11-03 15:45
107.172.15.18057041b38…—query2026-11-03 15:42
111.228.56.161b2daa5fe…—query2026-11-03 15:40
120.48.131.5595d27e48…—query2026-11-03 15:39
8.135.30.162071b9ce8…—query2026-11-03 15:37
82.158.89.192aac11724…—query2026-11-03 15:35
107.149.88.739b13d564…—query2026-11-03 15:33
47.99.48.84439c89e2…—query2026-11-03 15:30
104.207.150.173722e2030…—query2026-11-03 15:22
8.140.228.20214bcb8b8…—query2026-11-03 15:19
8.135.30.1628669ce7b…—query2026-11-03 15:17
192.255.249.24394899163…—query2026-11-03 13:05
178.107.169.1153c736e0e…—query2026-11-03 13:05
152.89.170.20723251f5f…—query2026-11-03 13:05