OK
reachable
Chrome 147 macOS
· Chrome 147.0.0 / macOS Bot
Scraper
Policy:
Silent Throttle
Probability
89 %
Confidence
94 %
Risk Profile
VeryHigh
Threat
None
Hit Count
1
Last Seen
1m ago
Closest to
Chrome Desktop
Drift vs
36.7%
Fingerprint Profile
TLS Version
TLSv1.3
HTTP Protocol
HTTP/1.1
Protocol Client
TLS_AES_256_GCM_SHA384
TCP OS Hint
Unavailable
Fingerprint Integrity
Suspect
UA Consistency
Consistent
Headless Indicator
Low
Datacenter IP
Clean
Browser modes same browser, different modes. One row per persisted mode
| Mode | Observations | Maturity | Shift from baseline | Last seen |
|---|---|---|---|---|
| bot-raw | 3635 | 3635 | 0.07 (sec ch ua brands ordered, accept, accept encoding ordered) | 11:17:29 |
| signalr-negotiate | 85 | 85 | 0.37 (header order hash, header case pattern, accept encoding ordered) | 11:10:43 |
| websocket-upgrade | 4 | 4 | 0.39 (cache control pragma, header order hash, header case pattern) | 06:46:44 |
| sub-resource | 7 | 7 | 0.45 (ua family, header order hash, priority) | 22:10:10 |
| navigation | 770 | 770 | 0.32 (sec ch ua brands ordered, accept, accept encoding ordered) | 18:15:57 |
5 modes across 4501 observations. See composite browser-mode fingerprints.
Endpoints Visited (1) Click to expand · stats unavailable
| # | Path |
|---|---|
| 1 | /.git/config |
Raw Requests (1) Click to expand
| Time | Method | Path | Status | Prob | Conf | Risk Profile | Action | Time |
|---|---|---|---|---|---|---|---|---|
| 08:43:40 | GET | /.git/config | 200 | 100 % | 100 % | VeryHigh | Silent Throttle | 11.7ms |
User Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Analysis
Chrome 147 macOS on /.git/config - caught by Tier 1 honeypot hit: /.git/config matched /.git/config, Request patterns appear normal, IP appears normal: 45.67.85.xxx
Detection Signals
- • Tier 1 honeypot hit: /.git/config matched /.git/config
- • Request patterns appear normal
- • IP appears normal: 45.67.85.xxx
- • TLS connection appears normal
- • No bot marker in User-Agent (weak human lean; UA is easily spoofed)
Detector Contributions (19 detectors)
| Detector | Confidence Delta | Timing (ms) |
|---|---|---|
|
HeuristicLate
Heuristic model (late): 100 % bot likelihood (297 features)
|
+0.991 | 0.3 |
|
HoneypotLink
Tier 1 honeypot hit: /.git/config matched /.git/config
|
+0.950 | 0.1 |
|
Heuristic
Heuristic model (early): 93 % bot likelihood (25 features)
|
+0.857 | 0.1 |
|
Ip
IP appears normal: 45.67.85.xxx
|
-0.150 | 0.0 |
|
Behavioral
Request patterns appear normal
|
-0.150 | 0.1 |
|
TlsFingerprint
TLS connection appears normal
|
-0.150 | 0.0 |
|
UserAgent
No bot marker in User-Agent (weak human lean; UA is easily spoofed)
|
-0.050 | 0.5 |
|
Http2Fingerprint
Using HTTP/1.1 instead of HTTP/2 (HTTP/2 rate: 78 % over 361 samples)
|
+0.078 | 0.0 |
|
AI
AI analysis: borderline case, monitoring
|
+0.000 | 10.2 |
|
Header
Browser UA without Accept-Language; deployment norm is low language rate (49 % over 353 samples)
|
+0.000 | 0.1 |
|
AiScraper
No AI scraper signals detected
|
+0.000 | 0.1 |
|
VerifiedBot
No known bot UA pattern
|
+0.000 | 0.0 |
|
SecurityTool
No security tools detected in User-Agent
|
+0.000 | 0.1 |
|
RequestHydrator
Request signals hydrated to sink
|
+0.000 | 0.0 |
|
Http3Fingerprint
Connection uses HTTP/1.1 (not HTTP/3)
|
+0.000 | 0.0 |
|
TcpIpFingerprint
Network fingerprint analysis complete (no anomalies detected)
|
+0.000 | 0.0 |
|
HeaderCorrelation
2 signatures with similar headers from same IP (monitoring)
|
+0.000 | 0.0 |
|
TransportProtocol
Transport protocol analysis complete
|
+0.000 | 0.0 |
|
FastPathReputation
No known patterns in reputation cache
|
+0.000 | 0.0 |
Signal Intelligence
request
protocol
HTTP/1.1
accept_encoding
gzip, br, deflate
risk
justification
Verified bad bot
tls
cipher
TLS_AES_256_GCM_SHA384
Version
TLSv1.3
version
TLSv1.3
Policy applied
Hit history
No sessions recorded yet.
Sessions are created when a visitor's activity gap exceeds 30 minutes.
Effective policy
Loading effective policy…
ASP.NET Pack — Auth events
JWKS reachable
Licensed
ASP.NET pack enabled
OTel Mesh — Traces
Fingerprint timeline
ded5c18040d341c5934a4b0483b93a3c
0 observations
Span + log activity for this fingerprint, ordered by timestamp.
No timeline observations
OTel Mesh receiver online, but no observations seen for this fingerprint id (check W3C baggage propagation)
Signature:
wurqcIpcVW1rvw1hrvZNoA
|
Processing: 12ms
|
Country: GB
|
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
|
First seen: 2026-07-16 08:43:40 UTC