OK
reachable
Firefox 149 macOS
· Firefox 149.0 / macOS Human
Scraper
Policy:
Silent Throttle
Probability
0 %
Confidence
93 %
Risk Profile
VeryLow
Threat
None
Hit Count
1
Last Seen
52s ago
Drifted
Generic Adblocker
→
Firefox Desktop
Drift vs
48.8%
Fingerprint Profile
TLS Version
TLSv1.3
HTTP Protocol
HTTP/1.1
Protocol Client
TLS_AES_256_GCM_SHA384
TCP OS Hint
Unavailable
Fingerprint Integrity
Suspect
UA Consistency
Consistent
Headless Indicator
Low
Datacenter IP
Clean
Browser modes same browser, different modes. One row per persisted mode
| Mode | Observations | Maturity | Shift from baseline | Last seen |
|---|---|---|---|---|
| bot-raw | 348 | 348 | 0.31 (dnt, accept encoding ordered, accept) | 09:53:10 |
| signalr-negotiate | 23 | 23 | 0.42 (upgrade insecure requests, priority, ip subnet) | 08:41:47 |
| sub-resource | 52 | 52 | 0.48 (priority, ip subnet, sec gpc) | 08:41:46 |
| navigation | 655 | 655 | 0.18 (dnt, accept, upgrade insecure requests) | 08:41:41 |
4 modes across 1078 observations. See composite browser-mode fingerprints.
Endpoints Visited (1) Click to expand · stats unavailable
| # | Path |
|---|---|
| 1 | /.git/config |
Raw Requests (1) Click to expand
| Time | Method | Path | Status | Prob | Conf | Risk Profile | Action | Time |
|---|---|---|---|---|---|---|---|---|
| 08:19:35 | GET | /.git/config | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 12.0ms |
User Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0
Analysis
Firefox 149 macOS on /.git/config - caught by Tier 1 honeypot hit: /.git/config matched /.git/config, Request patterns appear normal, IP appears normal: 88.151.33.xxx
Detection Signals
- • Tier 1 honeypot hit: /.git/config matched /.git/config
- • Request patterns appear normal
- • IP appears normal: 88.151.33.xxx
- • TLS connection appears normal
- • No bot marker in User-Agent (weak human lean; UA is easily spoofed)
Detector Contributions (19 detectors)
| Detector | Confidence Delta | Timing (ms) |
|---|---|---|
|
HeuristicLate
Heuristic model (late): 100 % bot likelihood (296 features)
|
+0.993 | 0.3 |
|
HoneypotLink
Tier 1 honeypot hit: /.git/config matched /.git/config
|
+0.950 | 0.4 |
|
Heuristic
Heuristic model (early): 94 % bot likelihood (24 features)
|
+0.887 | 0.1 |
|
Ip
IP appears normal: 88.151.33.xxx
|
-0.150 | 0.0 |
|
Behavioral
Request patterns appear normal
|
-0.150 | 0.1 |
|
TlsFingerprint
TLS connection appears normal
|
-0.150 | 0.0 |
|
UserAgent
No bot marker in User-Agent (weak human lean; UA is easily spoofed)
|
-0.050 | 0.6 |
|
AI
AI analysis: borderline case, monitoring
|
+0.000 | 10.2 |
|
Header
Browser UA without Accept-Language; deployment norm is low language rate (50 % over 283 samples)
|
+0.000 | 0.1 |
|
AiScraper
No AI scraper signals detected
|
+0.000 | 0.1 |
|
VerifiedBot
No known bot UA pattern
|
+0.000 | 0.0 |
|
SecurityTool
No security tools detected in User-Agent
|
+0.000 | 0.0 |
|
RequestHydrator
Request signals hydrated to sink
|
+0.000 | 0.0 |
|
Http2Fingerprint
Using HTTP/1.1; environment norm is HTTP/1.1 (0 % HTTP/2 over 41 samples)
|
+0.000 | 0.0 |
|
Http3Fingerprint
Connection uses HTTP/1.1 (not HTTP/3)
|
+0.000 | 0.0 |
|
TcpIpFingerprint
Network fingerprint analysis complete (no anomalies detected)
|
+0.000 | 0.0 |
|
HeaderCorrelation
Single signature per header profile
|
+0.000 | 0.0 |
|
TransportProtocol
Transport protocol analysis complete
|
+0.000 | 0.0 |
|
FastPathReputation
No known patterns in reputation cache
|
+0.000 | 0.0 |
Signal Intelligence
request
protocol
HTTP/1.1
accept_encoding
gzip, br, deflate
risk
justification
Verified bad bot
tls
cipher
TLS_AES_256_GCM_SHA384
Version
TLSv1.3
version
TLSv1.3
Policy applied
Hit history
No sessions recorded yet.
Sessions are created when a visitor's activity gap exceeds 30 minutes.
Effective policy
Loading effective policy…
ASP.NET Pack — Auth events
JWKS reachable
Licensed
ASP.NET pack enabled
OTel Mesh — Traces
Fingerprint timeline
66e991759d5e475399b3a116b154139b
0 observations
Span + log activity for this fingerprint, ordered by timestamp.
No timeline observations
OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)
Signature:
d0As625xpLSwtTYPUXZiYw
|
Processing: 12ms
|
Country: NL
|
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 15.7; rv:149.0) Gecko/20100101 Firefox/149.0
|
First seen: 2026-07-16 08:19:35 UTC