Known malicious kitlowother

AIClient2API panels reachable from the internet

family: aiclient2api-panel-2026-11

Tracks internet-reachable admin panels of AIClient2API, an open-source, self-hosted proxy that exposes AI provider accounts and command-line clients through one API. One public threat list groups these panels with consoles of the ARTEX penetration-testing system; treat that as a lead, not as attribution. Matches the panel's title, the project's favicon and the structure of three of its scripts, which survives a change of name. A match identifies the software, not how it is used.

Anchors

SMQL queryrun
title:"AIClient2API" OR favicon_hash:1480259189 OR (fp_canonical:bc33081689df4e9c77c469427c1bdef5f85ba829e6f3afe949b5373256715121 AND fp_canonical:6408385d06bca69ec2721658bb77f75ea96ef3b6049522be98e0f6c4147a94a3 AND fp_canonical:5c66816002a5ba44e5dbec2032b41dc3d4d4a13803edfaf639c57699ffc82285)

Provenance

Added: 2026-11-02 17:08
The panel opens on a sign-in page at /login.html, directly on a port such as 3000 or behind a reverse proxy. Its title reads "AIClient2API - 管理控制台" or "登录 - AIClient2API", and translated versions exist. Operators can rename the panel, so the title and favicon can change while the script structure stays. Confirm unauthorized use before treating a sighting as hostile.

Sightings (20)Atom feed

HostScanScriptMatchScanned
43.134.43.24b2fe18a5…—query2026-11-02 19:04
183.87.152.2040b34f245…—query2026-11-02 19:04
43.156.152.13050c45016…—query2026-11-02 19:04
192.119.102.133b85df8c6…—query2026-11-02 19:04
51.75.147.1620ee170aa…—query2026-11-02 19:04
183.87.152.204893ac390…—query2026-11-02 16:04
192.119.102.133420ca6e7…—query2026-11-02 16:03
43.156.152.130c808d29e…—query2026-11-02 16:02
43.134.43.2468444ccf…—query2026-11-02 16:02
51.75.147.1624ca206dc…—query2026-11-02 16:00
glados.k.vud6018618…—query2026-11-02 15:58
a2a.baibaomen.com82c31459…—query2026-11-02 15:58
node1.core-link.top7487c464…—query2026-11-02 15:57
webui.valkyrie.web.ide7945911…—query2026-11-02 15:56
mail.tancheetiong.com544f682a…—query2026-11-02 15:55
as.xiaohuliyiyi.com7b70d997…—query2026-11-02 15:54
relay.ttym.spaceed9ead5b…—query2026-11-02 15:53
api.453252.xyz7c2e4fb7…—query2026-11-02 15:53
api.managpt.ir03c156e3…—query2026-11-02 15:52
aiclient2api.itssx.comeede0f81…—query2026-11-02 15:51