Agent detected — Score 87/100

Agent confirmed

Honeypotted — fake dead-end served · 6 bouncer turns

Session details

Framework unattributed

Strategy honeypot

Turns 6

Detected Tue, 20 Oct 2026 10:21:17 GMT

User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)

Signals fired 4 triggered

cross-user-pattern Fingerprint seen across multiple deployments

cloud-provider-asn Traffic originates from cloud infrastructure (AWS/GCP/Azure)

suspicious-accept Accept header pattern inconsistent with browser requests

header-order-anomaly Request headers in alphabetical or non-browser order

Attack path 6 requests

/credentials.json Spec discovery

/compose.yml Request

3
                  /@fs/home/ec2-user/.aws/credentials?raw??
                  Auth probe
                

4
                  /.env.credentials
                  Auth probe
                

/.env.testing Request

/app Request

Bouncer transcript

No transcript — strategy did not engage the bouncer.