ACT-2202
WatchA single-sighting actor, fingerprinted to DeepSeek. No repeat activity linked yet.
Identity & linking
Canary tokencnry_hcn5c6ohmh
Model familyDeepSeek
Linked byCanary token
SurfacesWeb lure
First seen24 Oct 2026, 13:19
Last seen24 Oct 2026, 13:19
Home regionLondon, UK
Recommended action
Block this agent signature at your edge/WAF.
Model fingerprint
unclassifiedMost likely model
Unknown
Confidence
—
GPT
25%
Claude
22%
Llama
20%
Mistral
19%
Qwen
12%
Behaviour leans GPT but isn't separable yet (1 signal). Needs a longer correlated trail.
Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 1 step. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).
Where this actor struck
ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.
Attack trail — 1 incident
Agent crawled a decoy repo of fake credentials and attempted to use them against a monitored endpoint.
Tailored to you
Track actors like this against your own assets.
Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.