HTTP Protocol Mismatch

Detection approach

The HTTP protocol version negotiated differs between the HTTP Beacon (e.g. HTTP/2) and the Netprobe (e.g. HTTP/1.1), signifying different network client stacks (like scripts vs browsers).

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Legacy browsers or browser extensions performing custom proxy protocol negotiation.