Known malicious kitlowother

CyberStrikeAI consoles reachable from the internet

family: cyberstrikeai-console-2026-11

Tracks internet-reachable consoles of CyberStrikeAI, an open-source framework in which a language model on the server plans post-exploitation steps and a command-and-control implant carries them out on compromised hosts. Kaspersky reported it in intrusions against education organizations in Africa and Latin America, where it took attackers from reconnaissance to full domain compromise. Matches the console's own page structure, which survives a change of product name, plus the project's favicons and its default self-signed certificate. A match identifies the software, not how it is used: the project is also used for authorized penetration testing.

Anchors

SMQL queryrun
hunting_rule:CyberStrikeAI_Console OR favicon_hash:-1349384020 OR favicon_hash:-1149488178 OR favicon_hash:-1938875522 OR favicon_hash:-1259697202 OR favicon_hash:-1389405690 OR favicon_hash:993855671 OR favicon_hash:-391894939 OR cert_issuer:"CyberStrikeAI"

Provenance

Added: 2026-11-02 10:36
The console shows a sign-in page and usually listens on port 8080. Its default certificate is generated at every start with the product name as subject and issuer, and its validity begins one hour before that start, so the date shows the last restart. Operators rename the product: the title, the certificate name and the favicon can all change while the page structure stays. Consoles older than version 1.3.25 match on the favicon or certificate only. The intrusion infrastructure named in the Kaspersky report is 104[.]234[.]26[.]163, 185[.]186[.]245[.]144 and fastcdn[.]bar. Confirm unauthorized use before treating any other sighting as hostile.

Sightings (123)Atom feed

HostScanScriptMatchScanned
104.234.26.1631fe28737…—query2026-11-02 14:29
49.234.149.226b282ef89…—query2026-11-02 13:54
ai.1024.surf27a887c5…—query2026-11-02 13:53
cyberstrike.x247.tech70825a89…—query2026-11-02 13:52
cyber.wxyang.one3c1be069…—query2026-11-02 13:51
111.229.203.9248c40691…—query2026-11-02 13:50
191.44.109.26a1c5b68f…—query2026-11-02 13:49
root.migu.ceodb984fe6…—query2026-11-02 13:48
zerodusk.onlinecc48d188…—query2026-11-02 13:46
130.94.10.204edaf98f9…—query2026-11-02 13:45
xioskins.comf67f75d8…—query2026-11-02 13:44
45.204.71.851cee743c…—query2026-11-02 13:43
45.125.32.79b414ce68…—query2026-11-02 13:42
ai.clickepro.come3b60637…—query2026-11-02 13:41
209.126.10.1296315b2b7…—query2026-11-02 13:40
47.111.99.76aa75bbb6…—query2026-11-02 13:39
cs.wydwlh.icu43662b0e…—query2026-11-02 13:38
cs.hankaigc.xyz51a1465f…—query2026-11-02 13:37
101.43.169.2450b84a900…—query2026-11-02 13:36
107.174.144.145cf03e02b…—query2026-11-02 13:35
mchanelvps.softether.netb7992a1d…—query2026-11-02 13:34
srv1586555.hstgr.clouddff5cee3…—query2026-11-02 13:33
st.113438.xyzc4f1f6c4…—query2026-11-02 13:32
82.156.73.177ac51bee2…—query2026-11-02 13:31
csai.hkinfosecurity.coma91d5fe2…—query2026-11-02 13:30
1.94.11.11829447f37…—query2026-11-02 13:29
47.98.51.2109568de4…—query2026-11-02 13:28
adobe.sd2-api.comdc475250…—query2026-11-02 13:27
195.128.248.38bf422266…—query2026-11-02 13:26
117.50.187.12396e445d0…—query2026-11-02 13:25
121.40.47.149d366dd35…—query2026-11-02 13:24
c.aw766.eu.orgb6501635…—query2026-11-02 13:23
cyber.sa.568131.xyzbd6eb22d…—query2026-11-02 13:22
1.12.74.49bdfaa79f…—query2026-11-02 13:21
soc.10k.ccwu.cc5646d6ca…—query2026-11-02 13:20
118.107.47.1120ef2a9e…—query2026-11-02 13:18
hounded.internet-money.xyz8912203b…—query2026-11-02 13:17
171.34.206.4a7c3d077…—query2026-11-02 13:16
118.25.186.119cbdeb0e6…—query2026-11-02 13:15
ai.wechatupdate.help98525ba7…—query2026-11-02 13:14
43.139.87.203aa175ddd…—query2026-11-02 13:13
103.146.230.660fda1005…—query2026-11-02 13:12
43.110.35.1890d93dbe7…—query2026-11-02 13:11
192.253.229.28855742ec…—query2026-11-02 13:10
124.223.36.16ef9a3072…—query2026-11-02 13:09
cyb.nixigo.topc9fd9d0e…—query2026-11-02 13:08
192.129.145.15389cec76…—query2026-11-02 13:07
124.221.73.1322b952771…—query2026-11-02 13:06
198.23.232.6b463081d…—query2026-11-02 13:05
82.157.157.547dcd976d…—query2026-11-02 13:04
161.33.139.8ce728001…—query2026-11-02 13:03
169.58.246.69a8e8b405…—query2026-11-02 13:02
101.96.237.195224426fa…—query2026-11-02 13:01
cy.fuhuagoogle.top81a655d7…—query2026-11-02 13:00
hermes-webui-lpv1.srv1586555.hstgr.cloud15b581b7…—query2026-11-02 12:59
192.253.229.113aafc5b2b…—query2026-11-02 12:58
118.107.47.172f1c3d06…—query2026-11-02 12:57
strike.tangbyte.com0fa48652…—query2026-11-02 12:56
vd.cc.cd4dfca6f9…—query2026-11-02 12:55
154.44.26.72c27f0d44…—query2026-11-02 12:54
47.238.7.19821b9d056…—query2026-11-02 12:53
13.140.181.2222d0fef6a…—query2026-11-02 12:52
47.120.48.4762170b01…—query2026-11-02 12:51
38.76.203.204aeecadab…—query2026-11-02 12:50
v2.161886.xyz0fe3bf38…—query2026-11-02 12:49
strike.l11.li878f853d…—query2026-11-02 12:48
ks2csai.z321.de4bd93e75…—query2026-11-02 12:47
124.221.210.109610060ef…—query2026-11-02 12:46
43.139.224.13895c7cdd9…—query2026-11-02 12:45
csai.tarxf.com4b9ddfcb…—query2026-11-02 12:44
82.29.71.1609a0f029e…—query2026-11-02 12:43
169.58.160.2441282fca5…—query2026-11-02 12:42
43.153.147.15185dbe97b…—query2026-11-02 12:41
175.24.198.1841c9e5c47…—query2026-11-02 12:40
cs.113438.xyzd67c393a…—query2026-11-02 12:39
203.83.10.1142dd38f60…—query2026-11-02 12:38
ai.catroot.cc0c42306f…—query2026-11-02 12:37
188.166.181.202e6f92738…—query2026-11-02 12:36
149.104.29.60168e4e3f…—query2026-11-02 12:35
cyberstrike.168-110-206-41.sslip.iod4d2bfb7…—query2026-11-02 12:34
111.230.70.78a796e544…—query2026-11-02 12:33
118.107.47.13e2177c62…—query2026-11-02 12:32
192.236.166.737b02377b…—query2026-11-02 12:31
182.214.108.17938ebdbdb…—query2026-11-02 12:30
103.47.83.20bdad5e20…—query2026-11-02 12:29
117.72.96.239c7f32f26…—query2026-11-02 12:28
huiyetalk.duckdns.org1c112985…—query2026-11-02 12:27
138.201.205.1226600b8ba…—query2026-11-02 12:26
198.12.106.1078280f1a6…—query2026-11-02 12:25
45.192.212.85b3905532…—query2026-11-02 12:24
suihua.eu.ccc6816d7c…—query2026-11-02 12:23
124.223.96.116ea901401…—query2026-11-02 12:22
38.55.192.24459bb286a…—query2026-11-02 12:21
43.138.216.8325c13515…—query2026-11-02 12:20
9router-n92a.srv1586555.hstgr.cloud99d2b296…—query2026-11-02 12:19
120.46.48.454ab58665…—query2026-11-02 12:18
cyberstrike.yucc.xyz6307e325…—query2026-11-02 12:17
103.143.81.462b39aba4…—query2026-11-02 12:16
156.233.235.16409df6030…—query2026-11-02 12:15
111.228.35.247372a2a50…—query2026-11-02 12:14
111.230.148.147fc1c073d…—query2026-11-02 12:13
strix.loupes.com.cnb7cd2f2b…—query2026-11-02 12:12
45.204.71.486255c2e0…—query2026-11-02 12:11
192.255.206.71807c5f00…—query2026-11-02 12:10
cc.hackrss.net598c1991…—query2026-11-02 12:09
webapp.gofun.cc.cd570edcf6…—query2026-11-02 12:08
106.53.28.109e12ef3e5…—query2026-11-02 12:07
82.29.53.133d0b35d75…—query2026-11-02 12:06
124.223.76.604a297623…—query2026-11-02 12:05
129.146.177.249a0a94a8b…—query2026-11-02 12:04
scan.jueqiai.com6a8f1cbb…—query2026-11-02 10:17
mg.uabs.siteff7ed708…—query2026-11-02 10:08
23.132.132.30422d2094…—query2026-11-02 10:08
sec.resonara.ca6148040a…—query2026-11-02 10:08
23.95.130.1401880be3f…—query2026-11-02 10:08
sec.syc007.onlineb0f2e2c0…—query2026-11-02 10:08
ylzztsub.win6b2973e6…—query2026-11-02 10:08
nanabake.comcfc508d6…—query2026-11-02 10:08
52.128.241.77d4e5a06f…—query2026-11-02 10:08
ec2-3-20-114-34.us-east-2.compute.amazonaws.com3f7ef4ca…—query2026-11-02 10:08
167.104.99.17e9a5f979…—query2026-11-02 10:08
work.livis.cloudf6200030…—query2026-11-02 10:08
104.234.26.1632ea8ec3e…—query2026-11-02 10:03