Known malicious kitlowother
RedAmon consoles reachable from the internet
family: redamon-console-2026-11
Short link:scanmalware.com/h/358
Tracks internet-reachable consoles of RedAmon, an open-source system in which AI agents map a target's attack surface and carry out penetration-testing steps on their own. Threat researchers list it among the AI pentest frameworks exposed on the internet. Matches its title, the project's favicon and two modules of its web application. A match identifies the software, not how it is used: the project is also used for authorized testing.
Anchors
SMQL queryrun
title:"RedAmon" OR favicon_hash:964522141 OR (fp_canonical:3287a56f325c52d36f700160222889384e1455e1112f7f653e54ae4abd85155b AND fp_canonical:18ece7cd63aef93584d17382247d773de854f7cd26475da29128f44a6176432e)Provenance
Added: 2026-11-10 23:30
The console usually listens on port 3000 or 443 and shows a sign-in page; its data calls are refused until someone signs in. A build that changes the title, the favicon and those two modules is not covered. Confirm unauthorized use before treating a sighting as hostile.