Malicious AI API call - token jacking exact User-Agent Go-http-client/2.0,gzip(gfe) with transfer-station host indicator

Duo Tech@duotech

•updated Aug 6, 2026•1•0•11

This rule detects outbound network traffic indicative of AI token jacking, where compromised API keys are utilized through unauthorized gray-market proxy platforms. It identifies requests originating from internal hosts using the specific, anomalous User-Agent string 'Go-http-client/2.0,gzip(gfe)' in conjunction with HTTP host headers associated with known AI 'transfer-station' services such as 'new-api' or 'one-api'. This signature is designed to distinguish malicious exploitation from benign Go-based service traffic, while explicitly excluding known internal service accounts to minimize false positives.