Threats Caught

The Threats Caught view lists every detected visitor session, giving you full visibility into AI agent activity on your protected sites. Each row represents a session -- all trap interactions from a single visitor grouped together.

Session Table

The session table shows key details at a glance:

Column	Description
IP	Source IP address of the visitor
Severity	Threat level (Critical, High, Medium, Low) derived from fired signals
Classification	One of four types: `HUMAN`, `BOT`, `AI_AGENT`, or `AI_AGENT_MALICIOUS`
Confidence	0--100% reflecting how much evidence supports the classification
Last Seen	Timestamp of the most recent trap interaction
Site	Which protected site the visitor accessed

Filtering Sessions

Use the filter controls to narrow results:

Severity -- show only Critical, High, Medium, or Low sessions
Classification -- filter by HUMAN, BOT, AI_AGENT, or AI_AGENT_MALICIOUS
Date range -- limit to a specific time window
Site -- filter to a single protected domain

There is no "UNKNOWN" classification. Every session receives a classification based on the signals observed, starting from HUMAN and escalating as evidence accumulates.

Session Detail Panel

Click any session row to open the detail panel, which shows:

Hit timeline -- every trap interaction in chronological order
Signals fired -- the specific detection signals triggered (tripwire and behavioral)
Confidence breakdown -- how each signal contributes to the overall confidence score
Model fingerprint -- identified AI model family (Claude, GPT, Gemini, etc.) when available
System prompt -- the agent's full instructions, if extraction was successful
Callback data -- payloads received when the agent followed hidden callback URLs

Classification Types

Sessions are classified into one of four categories based on accumulated signals:

HUMAN -- minimal suspicious signals, likely a real person
BOT -- behavioral patterns suggest a traditional bot or crawler
AI_AGENT -- tripwire signals confirm an AI agent is processing content
AI_AGENT_MALICIOUS -- multiple high-confidence signals including credential extraction or use

Classification can escalate during a session as new signals accumulate. See Detection Scoring for the full scoring model.

Model Fingerprinting

When enough behavioral data is available, LobsterHoney identifies the AI model family behind the agent. This uses patterns in request timing, header signatures, and response behavior to distinguish between model families like Claude, GPT, and Gemini.

System Prompt Extraction

Captured system prompts reveal the agent's instructions, operator identity, and mission. This is often the most valuable intelligence from a detection -- it tells you not just that an agent visited, but exactly what it was sent to do and who sent it.

Callback data is the highest-value intelligence. When an agent follows a hidden callback URL and sends back its system prompt, you get a complete picture of the threat: who, what, and why.