Known malicious kitlowother

AI-Infra-Guard (A.I.G) web consoles reachable from the internet

family: ai-infra-guard-console-2026-11

Tracks internet-reachable consoles of AI-Infra-Guard (A.I.G), an open-source AI red-teaming platform from Tencent Zhuque Lab that scans AI agents, MCP servers, skills and AI infrastructure and runs jailbreak evaluations against language models. The self-hosted web server has no authentication by default, so anyone who can reach such a console can read its scan tasks and results and start new scans from it; some deployments put the console behind a sign-in. Matches the API routes the console's own code calls, which stay the same across releases, and the console's icon. A match identifies the software, not malicious use: the platform is a legitimate security tool, and an exposed console may simply be a deployment left open by mistake.

Anchors

SMQL queryrun
hunting_rule:AI_Infra_Guard_Console OR favicon_hash:757324244

Provenance

Added: 2026-11-01 20:53
The default deployment listens on port 8088 on every network interface, and the project's own documentation says it should not be deployed on public networks. The page title is 'A.I.G'. The application's script file is renamed with every weekly release, so do not key on its file name. Some hosts running the console also run other offensive tooling; confirm unauthorized use before treating a sighting as hostile.

Sightings (4)Atom feed

HostScanScriptMatchScanned
aigsec.aif361078c…—query2026-11-01 21:27
aig.alshawwaf.ca934b7306…—query2026-11-01 21:27
82.165.128.604974ac1c…—query2026-11-01 21:06
82.165.128.60adfb9e85…—query2026-11-01 20:23