Accept-Language Mismatch

Detection approach

The client's preferred languages (Accept-Language) differed between the beacon request and the out-of-band netprobe request, showing profile header forgery.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Multilingual users actively changing system language preferences mid-session.