Known malicious kitlowother
Strix result dashboards reachable from the internet
family: strix-viewer-2026-11
Short link:scanmalware.com/h/344
Tracks internet-reachable result dashboards of Strix, an open-source tool in which AI agents carry out penetration tests on their own. Threat researchers list it among the AI pentest frameworks exposed on the internet, next to PentAGI, Cairn and ARTEX. Matches the server banner the dashboard sends, its default title and the project's logo. A match identifies the software, not how it is used: the project is also used for authorized testing.
Anchors
SMQL queryrun
server:StrixViewer* OR title:"Strix Results" OR favicon_hash:-566184040Provenance
Added: 2026-11-03 19:35
The dashboard is started with strix view and listens on the local machine only unless it is told to bind to all interfaces. It then serves a single-page app titled Strix Results on the port it was given, such as 8080. Run data needs the access token printed when the dashboard starts, so a sighting shows the page shell only. Confirm unauthorized use before treating a sighting as hostile.