OK
reachable
Safari 17 macOS
· Safari 17.4.1 / macOS Human
Internal
Policy:
Allow
Probability
0 %
Confidence
94 %
Risk Profile
VeryLow
Threat
None
Hit Count
50
Last Seen
50s ago
Closest to
Safari Desktop
Drift vs
33.8%
Fingerprint Profile
TLS Version
Unavailable
HTTP Protocol
HTTP/1.1
Protocol Client
Unavailable
TCP OS Hint
Unavailable
Fingerprint Integrity
Consistent
UA Consistency
Suspect
Headless Indicator
Low
Datacenter IP
Clean
Browser modes same browser, different modes. One row per persisted mode
| Mode | Observations | Maturity | Shift from baseline | Last seen |
|---|---|---|---|---|
| bot-raw | 233 | 233 | 0.12 (priority, cache control pragma, header case pattern) | 07:30:17 |
| signalr-negotiate | 24 | 24 | 0.31 (priority, header case pattern, referer host family) | 15:00:06 |
| sub-resource | 85 | 85 | 0.32 (priority, cache control pragma, header order hash) | 09:50:52 |
| navigation | 3 | 3 | 0.32 (priority, cache control pragma, header order hash) | 09:50:51 |
4 modes across 345 observations. See composite browser-mode fingerprints.
Endpoints Visited (45) Click to expand · stats unavailable
| # | Path |
|---|---|
| 1 | /actuator/configprops |
| 2 | /.env |
| 3 | /%c0%ae%c0%ae/%c0%ae%c0%ae/.env |
| 4 | /resources../.env |
| 5 | /admin/debug |
| 6 | /actuator/gateway/routes |
| 7 | /....//....//....//....//proc/self/cmdline |
| 8 | /....//....//....//etc/ssh/sshd_config |
| 9 | /....//....//....//etc/nginx/nginx.conf |
| 10 | /....//....//....//root/.mysql_history |
| 11 | /....//....//etc/ssh/sshd_config |
| 12 | /....//....//etc/nginx/nginx.conf |
| 13 | /....//....//root/.bash_history |
| 14 | /....//home/ubuntu/.ssh/id_rsa |
| 15 | /....//var/www/html/wp-config.php |
| 16 | /..／..／home/ec2-user/.ssh/id_rsa |
| 17 | /..／home/www-data/.ssh/id_rsa |
| 18 | /..／root/.ssh/id_ed25519 |
| 19 | /..／proc/self/cmdline |
| 20 | /..／app/.env |
| 21 | /..／var/www/html/configuration.php |
| 22 | /..%c0%af..%c0%afhome/git/.ssh/id_rsa |
| 23 | /..%c0%afhome/ubuntu/.ssh/id_rsa |
| 24 | /..%c0%afvar/log/nginx/access.log |
| 25 | /..%c0%afvar/www/html/.env |
| 26 | /home/git/.ssh/id_rsa |
| 27 | /root/.ssh/id_ed25519 |
| 28 | /%2f../home/deploy/.ssh/id_rsa |
| 29 | /%2f../home/ubuntu/.ssh/id_rsa |
| 30 | /%2e%2e/proc/self/environ |
| 31 | /root/.ssh/id_rsa |
| 32 | /etc/passwd |
| 33 | /home/deploy/.ssh/id_rsa |
| 34 | /var/www/html/wp-config.php |
| 35 | /var/www/.env |
| 36 | /etc/hosts |
| 37 | /home/ubuntu/.ssh/id_ed25519 |
| 38 | /proc/self/cmdline |
| 39 | /var/www/.git/config |
| 40 | /telescope/api/commands |
| 41 | /.env. |
| 42 | /%u002e%u002e%u002f%u002e%u002e%u002fetc%u002fpasswd |
| 43 | / |
| 44 | /%2e%2e%2f%2e%2e%2fetc%2fpasswd |
| 45 | /public../.env |
Raw Requests (50) Click to expand
| Time | Method | Path | Status | Prob | Conf | Risk Profile | Action | Time |
|---|---|---|---|---|---|---|---|---|
| 04:04:00 | GET | /actuator/configprops | 200 | 65 % | 83 % | Low | Allow | 13.6ms |
| 04:03:21 | GET | /.env | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.6ms |
| 04:03:17 | GET | /%c0%ae%c0%ae/%c0%ae%c0%ae/.env | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.4ms |
| 04:02:58 | GET | /resources../.env | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 11.8ms |
| 04:02:46 | GET | /admin/debug | 200 | 24 % | 68 % | Low | Allow | 11.4ms |
| 04:02:44 | GET | /actuator/gateway/routes | 200 | 44 % | 81 % | Low | Allow | 13.9ms |
| 04:01:24 | GET | /....//....//....//....//proc/self/cmdline | 200 | 24 % | 68 % | Low | Allow | 11.7ms |
| 04:01:09 | GET | /....//....//....//etc/ssh/sshd_config | 200 | 38 % | 84 % | Low | Allow | 13.1ms |
| 04:01:08 | GET | /....//....//....//etc/nginx/nginx.conf | 200 | 90 % | 88 % | VeryHigh | Silent Throttle | 13.2ms |
| 04:01:05 | GET | /....//....//....//root/.mysql_history | 200 | 24 % | 68 % | Low | Allow | 11.8ms |
| 04:00:49 | GET | /....//....//etc/ssh/sshd_config | 200 | 88 % | 88 % | VeryHigh | Silent Throttle | 13.6ms |
| 04:00:47 | GET | /....//....//etc/nginx/nginx.conf | 200 | 65 % | 83 % | Low | Allow | 12.9ms |
| 04:00:46 | GET | /....//....//root/.bash_history | 200 | 24 % | 68 % | Low | Allow | 12.3ms |
| 04:00:25 | GET | /....//home/ubuntu/.ssh/id_rsa | 200 | 24 % | 68 % | Low | Allow | 12.3ms |
| 04:00:18 | GET | /....//var/www/html/wp-config.php | 200 | 57 % | 82 % | Low | Allow | 12.6ms |
| 04:00:16 | GET | /..／..／home/ec2-user/.ssh/id_rsa | 200 | 24 % | 68 % | Low | Allow | 11.3ms |
| 03:59:57 | GET | /..／home/www-data/.ssh/id_rsa | 200 | 24 % | 68 % | Low | Allow | 12.4ms |
| 03:59:56 | GET | /..／root/.ssh/id_ed25519 | 200 | 24 % | 68 % | Low | Allow | 12.1ms |
| 03:59:50 | GET | /..／proc/self/cmdline | 200 | 24 % | 68 % | Low | Allow | 11.3ms |
| 03:59:45 | GET | /..／app/.env | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 12.4ms |
| 03:59:42 | GET | /..／var/www/html/configuration.php | 200 | 88 % | 88 % | VeryHigh | Silent Throttle | 13.2ms |
| 03:59:34 | GET | /..%c0%af..%c0%afhome/git/.ssh/id_rsa | 200 | 71 % | 84 % | Low | Monitor Only | 14.2ms |
| 03:59:06 | GET | /..%c0%afhome/ubuntu/.ssh/id_rsa | 200 | 90 % | 88 % | VeryHigh | Silent Throttle | 14.2ms |
| 03:58:57 | GET | /..%c0%afvar/log/nginx/access.log | 200 | 89 % | 87 % | Low | Monitor Only | 13.9ms |
| 03:58:49 | GET | /..%c0%afvar/www/html/.env | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.5ms |
| 03:58:44 | GET | /home/git/.ssh/id_rsa | 200 | 10 % | 68 % | VeryLow | Allow | 12.5ms |
| 03:58:29 | GET | /root/.ssh/id_ed25519 | 200 | 12 % | 68 % | Low | Allow | 11.8ms |
| 03:57:12 | GET | /%2f../home/deploy/.ssh/id_rsa | 200 | 56 % | 81 % | Medium | Allow | 17.0ms |
| 03:57:12 | GET | /%2f../home/ubuntu/.ssh/id_rsa | 200 | 57 % | 81 % | Medium | Allow | 13.7ms |
| 03:56:14 | GET | /%2e%2e/proc/self/environ | 200 | 100 % | 100 % | VeryLow | Monitor Only | 11.8ms |
| 03:56:11 | GET | /root/.ssh/id_rsa | 200 | 10 % | 68 % | VeryLow | Allow | 13.6ms |
| 03:55:57 | GET | /etc/passwd | 200 | 100 % | 100 % | VeryLow | Monitor Only | 11.9ms |
| 03:55:56 | GET | /root/.ssh/id_rsa | 200 | 12 % | 68 % | Low | Allow | 12.0ms |
| 03:55:41 | GET | /home/deploy/.ssh/id_rsa | 200 | 12 % | 68 % | Low | Allow | 12.1ms |
| 03:55:33 | GET | /var/www/html/wp-config.php | 200 | 38 % | 84 % | Low | Allow | 14.0ms |
| 03:55:08 | GET | /var/www/.env | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.8ms |
| 03:54:41 | GET | /etc/hosts | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 12.3ms |
| 03:54:34 | GET | /home/ubuntu/.ssh/id_ed25519 | 200 | 56 % | 81 % | Medium | Allow | 13.3ms |
| 03:54:28 | GET | /proc/self/cmdline | 200 | 10 % | 68 % | VeryLow | Allow | 14.1ms |
| 03:54:10 | GET | /var/www/.git/config | 200 | 90 % | 88 % | VeryHigh | Silent Throttle | 12.3ms |
| 03:53:29 | GET | /telescope/api/commands | 200 | 12 % | 68 % | Low | Allow | 10.9ms |
| 03:52:38 | GET | /.env | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.6ms |
| 03:52:38 | GET | /.env. | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 12.3ms |
| 03:28:53 | GET | /%u002e%u002e%u002f%u002e%u002e%u002fetc%u002fpasswd | 200 | 12 % | 68 % | Low | Allow | 11.9ms |
| 03:28:46 | GET | / | 200 | 20 % | 88 % | Low | Allow | 14.1ms |
| 03:28:21 | GET | /%2e%2e%2f%2e%2e%2fetc%2fpasswd | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.4ms |
| 03:28:02 | GET | /etc/passwd | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 11.7ms |
| 03:27:50 | GET | /etc/passwd | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.6ms |
| 03:27:38 | GET | /etc/passwd | 200 | 100 % | 100 % | VeryLow | Monitor Only | 13.1ms |
| 03:27:37 | GET | /public../.env | 200 | 100 % | 100 % | VeryLow | Monitor Only | 12.5ms |
Bot Probability & Confidence History
StyloBot Detection Overhead (ms)
User Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
Analysis
Safari 17 macOS on /actuator/configp... - caught by Tier 2 honeypot hit: /actuator/configprops matched /actua..., User-Agent appears normal, No header/UA inconsistencies detected
Detection Signals
- • Tier 2 honeypot hit: /actuator/configprops matched /actuator*
- • User-Agent appears normal
- • No header/UA inconsistencies detected
- • Request patterns appear normal
- • Safari behavioral profile consistent (score=0.97)
Detector Contributions (33 detectors)
| Detector | Confidence Delta | Timing (ms) |
|---|---|---|
|
HeuristicLate
Heuristic model (late): 74 % bot likelihood (319 features)
|
+0.472 | 0.4 |
|
Heuristic
Heuristic model (early): 78 % human likelihood (19 features)
|
-0.564 | 0.1 |
|
HoneypotLink
Tier 2 honeypot hit: /actuator/configprops matched /actuator*
|
+0.750 | 0.2 |
|
Header
Headers appear normal
|
-0.150 | 0.0 |
|
UserAgent
User-Agent appears normal
|
-0.150 | 0.7 |
|
Behavioral
Request patterns appear normal
|
-0.150 | 0.2 |
|
Inconsistency
No header/UA inconsistencies detected
|
-0.150 | 0.1 |
|
ClaimedIdentity
Safari behavioral profile consistent (score=0.97)
|
-0.150 | 0.1 |
|
VersionAge
Safari v17 is 9 versions behind (latest: 26)
|
+0.100 | 0.0 |
|
Ip
Private network IP: 127.0.0.xxx
|
+0.100 | 0.0 |
|
TlsFingerprint
Using HTTP instead of HTTPS (uncommon for modern browsers)
|
+0.050 | 0.0 |
|
AI
AI analysis: borderline case, monitoring
|
+0.000 | 10.4 |
|
Llm
LLM detection disabled or unavailable
|
+0.000 | 0.0 |
|
Intent
Session intent: browsing (threat=0.05, band=None)
|
+0.000 | 0.6 |
|
AiScraper
No AI scraper signals detected
|
+0.000 | 0.0 |
|
Similarity
No prior visitor signatures to compare against yet
|
+0.000 | 0.0 |
|
StreamAbuse
Stream abuse check - non-streaming request
|
+0.000 | 0.0 |
|
VerifiedBot
No known bot UA pattern
|
+0.000 | 0.0 |
|
SecurityTool
No security tools detected in User-Agent
|
+0.000 | 0.1 |
|
CookieBehavior
No Set-Cookie headers observed
|
+0.000 | 0.0 |
|
ReputationBias
No learned reputation patterns matched
|
+0.000 | 0.0 |
|
ContentSequence
Document hit; sequence reset at /actuator/configprops
|
+0.000 | 0.1 |
|
ProjectHoneypot
Skipped: ProjectHoneypot is disabled in configuration
|
+0.000 | 0.0 |
|
ReactivePattern
No prior error events to analyze
|
+0.000 | 0.0 |
|
RequestHydrator
Request signals hydrated to sink
|
+0.000 | 0.0 |
|
Http2Fingerprint
Using HTTP/1.1; environment norm is HTTP/1.1 (9 % HTTP/2 over 187 samples)
|
+0.000 | 0.0 |
|
Http3Fingerprint
Connection uses HTTP/1.1 (not HTTP/3)
|
+0.000 | 0.0 |
|
ResponseBehavior
Response coordinator not configured
|
+0.000 | 0.0 |
|
TcpIpFingerprint
Network fingerprint analysis complete (no anomalies detected)
|
+0.000 | 0.0 |
|
HeaderCorrelation
Single signature per header profile
|
+0.000 | 0.1 |
|
TransportProtocol
Transport protocol analysis complete
|
+0.000 | 0.0 |
|
FastPathReputation
No known patterns in reputation cache
|
+0.000 | 0.0 |
|
MultiLayerCorrelation
Cross-signal consistency check complete (not enough data to compare)
|
+0.000 | 0.2 |
Signal Intelligence
referrer
domain
www.google.com
request
protocol
HTTP/1.1
accept_encoding
gzip, deflate, br, zstd
risk
justification
Trusted internal client (network position verified)
friendly_pin_trace
fired:bot_type=Internal (network-trusted)
Policy applied
Hit history
No sessions recorded yet.
Sessions are created when a visitor's activity gap exceeds 30 minutes.
Effective policy
Loading effective policy…
ASP.NET Pack — Auth events
JWKS reachable
Licensed
ASP.NET pack enabled
OTel Mesh — Traces
Fingerprint timeline
dc45aec70ab648cc94774ca7ecafddb7
0 observations
Span + log activity for this fingerprint, ordered by timestamp.
No timeline observations
OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)
Signature:
NQavMospOC3Ofx-jj4CGWQ
|
Processing: 14ms
|
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
|
First seen: 2026-07-14 03:27:37 UTC