Known malicious kitlowother
Xalgorix consoles reachable from the internet
family: xalgorix-console-2026-11
Short link:scanmalware.com/h/359
Tracks internet-reachable consoles of Xalgorix, an open-source security scanner in which AI agents carry out penetration-testing steps on their own. Threat researchers list it among the AI pentest frameworks exposed on the internet. Matches the console's default title and two versions of the project's logo. A match identifies the software, not how it is used: the project is also used for authorized testing.
Anchors
SMQL queryrun
title:"Xalgorix — Security Scanner" OR favicon_hash:-1852521790 OR favicon_hash:248472114Provenance
Added: 2026-11-10 23:30
The console usually listens on port 9137 and shows a sign-in page. The project's own website has a different title and is not matched. A build that changes the title and the logo is not covered. Confirm unauthorized use before treating a sighting as hostile.