DNS Routing Mismatch

Detection approach

The HTTP Beacon request was routed through a proxy or VPN, but the DNS resolver queries resolved natively via a local ISP nameserver. This geographic/ISP mismatch reveals an incomplete proxy tunnel.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Legitimate VPN users whose DNS requests leak natively through local home routers (DNS leak).