HTTP User-Agent Mismatch

Detection approach

The User-Agent header sent during the normal HTTP Beacon request contradicts the User-Agent header sent during the out-of-band Netprobe HTTPS request, indicating inconsistent browser profiles or proxy rotation.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Privacy-conscious browser extensions dynamically modifying User-Agent strings mid-session.