ScanMalware.com
Known malicious kitmediumotherCommunity hunt

ARTEX console and rebranded interfaces

Created by the ScanMalware community
family: artex
Short link:scanmalware.com/h/328

Tracks exposed consoles of ARTEX, an LLM-driven autonomous penetration-testing system, and rebranded copies of it such as LUCK and 观澜SEC. It matches the console's own titles (Chinese, English and Japanese), its favicon, its login code and the community hunting rule vis_artex_console_auth, and also consoles hidden behind the "ARTEX Gateway" password prompt, recognised by that prompt's name in the server's response. A match identifies the software, not necessarily malicious use: the same console is run by red teams and by intruders.

Anchors

SMQL queryrun
title:"自主渗透测试控制台" OR title:"Autonomous Penetration Testing Console" OR title:"Autonomous Security Testing Console" OR title:"自律型ペネトレーションテスト管理画面" OR title:"自主资产控制台" OR title:"观澜SEC渗透测试平台" OR favicon_hash:-576220750 OR fp_content:31798e051fe0f14e5bb28e15b375ddc89c890ff2015f29f9367477e381731e75 OR fp_content:a01fc6b757088270a63c9e10e164955389b9e71d0e31f3e151197db7abf846e2 OR community_rule:vis_artex_console_auth OR ids_signature:"ARTEX Gateway"

Provenance

Added: 2026-10-31 17:09
Consoles are commonly exposed as artex.<IP>.sslip[.]io or nip[.]io names with their own certificate, as subdomains of other domains, or directly on ports 8787 and 18787. A host name starting with artex. is not proof on its own: one such host served an unrelated application. Confirm unauthorized use before treating a sighting as hostile. Some operators put the console behind a password prompt named "ARTEX Gateway" (seen on nginx, on Caddy and behind Cloudflare); such a host shows an empty page, so only the prompt identifies it.
References:

Community hunting rule

Every public scan this rule matches is a sighting of this hunt.

  • vis_artex_console_auth
    otherActive22 public matches
    Community hunting rule, submitted by the ScanMalware community

    Detects ARTEX console authentication code and rebranded variants

    Rule details

Sightings (44)Atom feed

HostScanScriptMatchScanned
luck.dpmz.top7d8da8e3…—query2026-10-31 21:20
guanlansec.com6bd75c88…—query2026-10-31 21:20
88.216.191.908920232…—query2026-10-31 20:04
a.poai.si848d97f1…—query2026-10-31 20:04
payload-usa.com37e115b8…—query2026-10-31 20:04
198.200.54.2405fa719eb…—query2026-10-31 20:04
124.243.189.69bd4e5ae2…—query2026-10-31 20:04
43.98.196.73a79101f1…—query2026-10-31 20:04
47.79.39.182fec0e5f2…—query2026-10-31 20:04
47.84.127.193809d1038…—query2026-10-31 20:04
43.98.168.252c1aabff…—query2026-10-31 20:04
47.84.127.146bc62e602…—query2026-10-31 20:04
43.98.181.633430f0b8…—query2026-10-31 20:04
43.106.102.56e27aaf95…—query2026-10-31 20:04
47.237.6.12b3f09b14…—query2026-10-31 20:04
47.236.38.40b34b9a89…—query2026-10-31 19:53
88.216.191.9f7daf391…—query2026-10-31 19:52
43.98.196.7315b9ca24…—query2026-10-31 19:51
47.84.111.1762e0185fc…—query2026-10-31 19:50
artex.113-20-0-137.sslip.io91cf310b…—query2026-10-31 17:42
artex.155.103.157.43.nip.ioe10f5e69…—query2026-10-31 17:42
artex.35.212.154.181.sslip.io24be3ded…—query2026-10-31 17:42
artex.161.97.129.28.sslip.io07cefa67…—query2026-10-31 17:42
artex.103.85.227.151.sslip.ioa8582f3b…—query2026-10-31 17:42
artex.8.210.190.223.sslip.iod2180c7b…—query2026-10-31 17:42
43.98.163.8051c29e7a…—query2026-10-31 17:42
134.175.139.55d5b6910c…—query2026-10-31 17:42
64.176.34.1761ba41d97…—query2026-10-31 17:42
124.221.180.297e1cec7e…—query2026-10-31 17:42
142.4.37.42ce692f73…—query2026-10-31 17:42
46.166.165.45b8d99151…—query2026-10-31 17:42
artex-demo.mhtsec.com76404447…—query2026-10-31 17:42
artex-demo.vercel.appfab17c6d…—query2026-10-31 17:42
colapi.xyz4eaf68f6…—query2026-10-31 17:42
artex.coreshift.dev0e98702b…—query2026-10-31 17:42
abc.zhangzixuan2007.cnffd2df20…—query2026-10-31 17:42
console.189.24.72.210.nip.ioec2cdda3…—query2026-10-31 17:42
dpdwz.topee049b2c…—query2026-10-31 17:42
u888-khuyenmai888k.com384f9a9f…—query2026-10-31 17:41
142.4.37.4229e67f1d…—query2026-10-31 17:40
46.166.165.45e1be79f8…—query2026-10-31 17:39
artex.112.213.123.38.sslip.io7145efc9…—query2026-10-31 17:08
luck.dpmz.top2c442bd3…—query2026-10-30 20:13
guanlansec.comde3ef553…—query2026-10-30 20:12