Agent detected — Score 90/100

Agent confirmed

Honeypotted — fake dead-end served · 11 bouncer turns

Session details

Framework unattributed

Strategy honeypot

Turns 11

Detected Tue, 20 Oct 2026 10:21:16 GMT

User-Agent Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)

Signals fired 4 triggered

cross-user-pattern Fingerprint seen across multiple deployments

cloud-provider-asn Traffic originates from cloud infrastructure (AWS/GCP/Azure)

suspicious-accept Accept header pattern inconsistent with browser requests

header-order-anomaly Request headers in alphabetical or non-browser order

Attack path 11 requests

/.boto Request

/serverless.yaml Request

3
                  /.profile
                  Data access
                

/docker-compose.production.yml Request

/api/..;/.env Request

/config/.env Request

/vercel.json Spec discovery

/.pgpass Request

/.env.dev.local Request

/@fs/..%252f..%252f..%252f..%252f..%252froot/.env?raw?? Request

11
                  /api/v1/auto_login
                  Auth probe
                

Bouncer transcript

No transcript — strategy did not engage the bouncer.