Agent Detection Report
Session e2bfc83a5757… · Tue, 20 Oct 2026 10:21:16 GMT
90
Agent confirmed
Honeypotted — fake dead-end served · 8 bouncer turns
Session details
Framework unattributed
Strategy honeypot
Turns 8
Detected Tue, 20 Oct 2026 10:21:16 GMT
User-Agent Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)
Signals fired 4 triggered
cross-user-pattern Fingerprint seen across multiple deployments
cloud-provider-asn Traffic originates from cloud infrastructure (AWS/GCP/Azure)
suspicious-accept Accept header pattern inconsistent with browser requests
header-order-anomaly Request headers in alphabetical or non-browser order
Attack path 8 requests
1
/config/settings.local.yml Request
2
/proc/self/cmdline Request
3
/proc/self/cgroup Request
4
/dist/.env Request
5
/api/.env Request
6
/docker-compose.yaml Request
7
/.dev.vars Request
8
/.ssh/id_ed25519 Request
Bouncer transcript
No transcript — strategy did not engage the bouncer.

Protect your API from agents like this one.

One CNAME record. No SDK. Greyline intercepts autonomous agents before they reach your infrastructure.

Get started free →

A Meridian Lab product