ARTEX Exposed: OPSEC Lessons for Every IP Stresser Operator
Between late September and early October 2026, seven South Korean financial institutions watched their internet-facing loan and inquiry systems hand out personal, employment, income and loan records belonging to roughly 67,000 people and 2,200 corporations. The framework behind the campaign was ARTEX, an AGPL-licensed autonomous penetration testing tool built in China and driven primarily by DeepSeek v4.1 Flash. CrowdStrike and Genians published early reads on the intrusion, and Hunt.io's follow-up — covered by Security Affairs — mapped the infrastructure underneath it. What stuck with us is not the model stack but the housekeeping: a console on port 443, a jump host with an open directory, and a credentials file that politely named its own servers.
Fifteen Open Ports and a Password File With a Warning Label
Hunt.io's scanning put 38.244.50[.]120 on Cogent's network in Los Angeles with 15 open ports. The ARTEX login page answered on 443 and 8090, joined by a Gemini2API admin console and a Tinyproxy instance. From there the trail ran to 23.248.226[.]250, a Hong Kong jump server on AS138415 holding 42 files across two subdirectories — 105 MB of tooling, scripts and keys, sitting in an open directory. The platform had already logged warnings on September 5, September 26 and October 5. Nobody looked.
Three scripts kept reverse SSH tunnels alive, ran a local relay and copied files to the jump host; one tunnel was named grok2api. The credentials file carried keys for Zhipu AI's GLM models, an OpenAI-compatible relay and a proxy service. A comment inside it warns the operator never to paste credentials into a session. That comment shipped with the leak.
Claude Code With a DeepSeek Heart Transplant
The harness was Claude Code 2.1.221, started 510 times since August 4 — but it never spoke to Anthropic. A local proxy, ds-models-shim.py, intercepts the /v1/models call, which returns a 404 against a non-Anthropic backend, and answers with a hand-written model list. A second shim, xcai-effort-shim.py, bolts a reasoning setting onto DeepSeek because the backend otherwise skips that step. Requests travel Claude Code → Claude Code Router → xcai[.]pro → api.deepseek.com.
On top of that sat 19 custom skills with 147 recorded uses: code audit, reconnaissance, web injection, WAF bypass testing, authentication testing, Telegram Mini Apps, APK decompiling, cloud phone control and payment logic testing. Three self-registered test accounts with cash-in deposit API tokens, dated September 12, look like insecure direct object reference testing — the same flaw class both vendors described against Korean loan services. Elsewhere: a FOFA query script running on an expired membership and a backup key, a rotating proxy service at 154.201.79[.]246:443 where 79 unique exit IPs surfaced in the first 100 identities, and a staged JNDI/LDAP directory pulled on October 5 at 03:42 UTC that confirms command execution through a DNS callback.
The Same Servers That Break In Also Give You Away
Hunt.io then turned the framework's own fingerprints into a search primitive. A certificate issuer query returned 19 IP addresses. A malware classification query returned 1,303 addresses across 30 countries, led by the United States, China and Hong Kong. Matching the console's page title produced about 1,300 IPs and 21 distinct title strings in English, Chinese, Korean, Japanese, Russian, Portuguese and Vietnamese — 19 of them likely ARTEX consoles. A malware-name search surfaced 280 open directories, including a Seoul host at 130.94.31[.]86:18888 and an SMB reconnaissance toolkit at 156.251.11[.]39 whose test script writes artex_probe_11876.txt. Others carried DedeCMS and FangCMS exploit kits, a CAPTCHA bypass suite and a RuoYi/Spring admin console exploit.
One framework, many operators, all of them discoverable through the same three queries. That is what a recruitment beacon looks like from the outside.
What This Means for Anyone Running an IP Stresser
Swap the ARTEX console for a booter dashboard and the story does not change. An ip stresser panel is a login page, an API and a billing module; its TLS certificate, favicon hash, default error page and title tag are all searchable. A single leaked API key hands a stranger the whole botnet, and a misconfigured seller endpoint exposes customer lists, payment records and the origin addresses behind every ddos protection subscription you ever sold. We have watched enough panels go dark to know that takedowns rarely start with traffic — they start with a Shodan result.
The attack code is commodity. SYN flood, ACK flood, UDP amplification, fragmentation flood, TLS flood, HTTP GET flood, HTTP/2 Rapid Reset — anyone can rent the same layer 7 capacity from a dozen ddos for hire outfits, and any cloudflare bypass trick that works today is a cve patch away from dying tomorrow. What separates a stress testing platform that survives from one that ends up in a Hunt.io writeup is hygiene: admin interfaces behind VPNs and allowlists, rotated SSH keys, vaulted API tokens, least-privilege access to model gateways, and logs someone actually reads.
Our own record run is documented in achievements, and it happened because the plumbing held. If you want to see what a clean, well-kept ip stresser frontend feels like from the inside, the free stress test at /contact is one click away — no exposed directories required.