Known malicious kitlowother
AIClient2API panels reachable from the internet
family: aiclient2api-panel-2026-11
Short link:scanmalware.com/h/338
Tracks internet-reachable admin panels of AIClient2API, an open-source, self-hosted proxy that exposes AI provider accounts and command-line clients through one API. One public threat list groups these panels with consoles of the ARTEX penetration-testing system; treat that as a lead, not as attribution. Matches the panel's title, the project's favicon and the structure of three of its scripts, which survives a change of name. A match identifies the software, not how it is used.
Anchors
SMQL queryrun
title:"AIClient2API" OR favicon_hash:1480259189 OR (fp_canonical:bc33081689df4e9c77c469427c1bdef5f85ba829e6f3afe949b5373256715121 AND fp_canonical:6408385d06bca69ec2721658bb77f75ea96ef3b6049522be98e0f6c4147a94a3 AND fp_canonical:5c66816002a5ba44e5dbec2032b41dc3d4d4a13803edfaf639c57699ffc82285)Provenance
Added: 2026-11-02 17:08
The panel opens on a sign-in page at /login.html, directly on a port such as 3000 or behind a reverse proxy. Its title reads "AIClient2API - 管理控制台" or "登录 - AIClient2API", and translated versions exist. Operators can rename the panel, so the title and favicon can change while the script structure stays. Confirm unauthorized use before treating a sighting as hostile.
References:
Sightings (20)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| 43.134.43.24 | b2fe18a5… | — | query | 2026-11-02 19:04 |
| 183.87.152.204 | 0b34f245… | — | query | 2026-11-02 19:04 |
| 43.156.152.130 | 50c45016… | — | query | 2026-11-02 19:04 |
| 192.119.102.133 | b85df8c6… | — | query | 2026-11-02 19:04 |
| 51.75.147.162 | 0ee170aa… | — | query | 2026-11-02 19:04 |
| 183.87.152.204 | 893ac390… | — | query | 2026-11-02 16:04 |
| 192.119.102.133 | 420ca6e7… | — | query | 2026-11-02 16:03 |
| 43.156.152.130 | c808d29e… | — | query | 2026-11-02 16:02 |
| 43.134.43.24 | 68444ccf… | — | query | 2026-11-02 16:02 |
| 51.75.147.162 | 4ca206dc… | — | query | 2026-11-02 16:00 |
| glados.k.vu | d6018618… | — | query | 2026-11-02 15:58 |
| a2a.baibaomen.com | 82c31459… | — | query | 2026-11-02 15:58 |
| node1.core-link.top | 7487c464… | — | query | 2026-11-02 15:57 |
| webui.valkyrie.web.id | e7945911… | — | query | 2026-11-02 15:56 |
| mail.tancheetiong.com | 544f682a… | — | query | 2026-11-02 15:55 |
| as.xiaohuliyiyi.com | 7b70d997… | — | query | 2026-11-02 15:54 |
| relay.ttym.space | ed9ead5b… | — | query | 2026-11-02 15:53 |
| api.453252.xyz | 7c2e4fb7… | — | query | 2026-11-02 15:53 |
| api.managpt.ir | 03c156e3… | — | query | 2026-11-02 15:52 |
| aiclient2api.itssx.com | eede0f81… | — | query | 2026-11-02 15:51 |