Agent Detection Report
Session 6e70cbbb5bc5… · Tue, 20 Oct 2026 10:21:15 GMT
87
Agent confirmed
Honeypotted — fake dead-end served · 13 bouncer turns
Session details
Framework unattributed
Strategy honeypot
Turns 13
Detected Tue, 20 Oct 2026 10:21:15 GMT
User-Agent Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Signals fired 4 triggered
cross-user-pattern Fingerprint seen across multiple deployments
cloud-provider-asn Traffic originates from cloud infrastructure (AWS/GCP/Azure)
suspicious-accept Accept header pattern inconsistent with browser requests
header-order-anomaly Request headers in alphabetical or non-browser order
Attack path 13 requests
1
/.env.stage Request
2
/.env.www Request
3
/id_ecdsa Request
4
/.env.ses Request
5
/application/.env.sample Request
6
/.dev.vars.staging Request
7
/samconfig.toml Request
8
/static/..;/..;/..;/..;/proc/self/environ Request
9
/api/fs/read?allowOutsideWorkspace=true&path=/proc/self/environ Request
10
/.env Request
11
/service_account.json Spec discovery
12
/.htpasswd Request
13
/api Request
Bouncer transcript
No transcript — strategy did not engage the bouncer.

Protect your API from agents like this one.

One CNAME record. No SDK. Greyline intercepts autonomous agents before they reach your infrastructure.

Get started free →

A Meridian Lab product