38.244.50[.]120IP address
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported 3 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Inside a Global AI-Assisted Hacking Campaign“The jump server, 38.244.50[.]120, served as the default route for connections to targets.The jump server also ran additional AI sessions.”
-
AI-Driven tool ARTEX used in attacks against South Korean Banks“…ted with the activity described and hosted an ARTEX instance and open directory containing a Claude Code markdown document at hxxp://38.244.50[.]120:18899/.claude/CLAUDE.md.” continues the report.”
-
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms“The IP address "38.244.50[.]120" hosts the ARTEX instance suspected to be behind the attacks on Korean attacks”
Indicators reported together
named in the same reports- xcai[.]proin 3 reports
- hxxp://38.244.50[.]120:18899/.claude/CLAUDE.md.%E2%80%9Din 1 report
- 101.53.80[.]20in 1 report
- 205.214.59[.]31in 1 report
- 124.155.252[.]63in 1 report
- 154.201.79[.]246in 1 report
- 23.248.249[.]90in 1 report
- 23.158.220[.]98in 1 report
- 103.248.148[.]84in 1 report
- 203.160.133[.]172in 1 report
- 209.209.85[.]38in 1 report
- sectors[.]inin 1 report
- campaign[.]workin 1 report
- server[.]toolsin 1 report
- version[.]aiin 1 report
- hxxps://xcai[.]pro/v1Herein 1 report
- hxxps://xcai[.]pro/v1.Codexin 1 report
- hxxps://api.deepseek[.]com/v1.Localin 1 report
- attacks[.]inin 1 report
- retrieval[.]targetin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.