Known malicious kitlowother

Xalgorix consoles reachable from the internet

family: xalgorix-console-2026-11

Tracks internet-reachable consoles of Xalgorix, an open-source security scanner in which AI agents carry out penetration-testing steps on their own. Threat researchers list it among the AI pentest frameworks exposed on the internet. Matches the console's default title and two versions of the project's logo. A match identifies the software, not how it is used: the project is also used for authorized testing.

Anchors

SMQL queryrun
title:"Xalgorix — Security Scanner" OR favicon_hash:-1852521790 OR favicon_hash:248472114

Provenance

Added: 2026-11-10 23:30
The console usually listens on port 9137 and shows a sign-in page. The project's own website has a different title and is not matched. A build that changes the title and the logo is not covered. Confirm unauthorized use before treating a sighting as hostile.

Sightings (1)Atom feed

HostScanScriptMatchScanned
82.29.53.13313a8df72…—query2026-11-10 23:25