NRS-4074
WatchAgent crawled a decoy repo of fake credentials and attempted to use them against a monitored endpoint.
Detection details
Model familyQwen
ActorACT-2239 · 11 hits
Fingerprint confidence59%
BaitWeb lure
Chain—
Observed addresscnry_od6p59dctc
Infrastructure regionSingapore, SG
First seen9 Oct 2026, 09:46
Recommended action
Block this agent signature at your edge/WAF.
Evidence
Interaction logged against our decoy infrastructure. The address is described as observed interacting with bait — not as an accusation about any person.
Tailored to you
Get incidents like this for your own assets.
This is one detection from the public feed. Pro watches the wallets, contracts and sites you care about and alerts you — with the action to take — the moment a flagged agent touches them.