IP Address Inconsistency

Detection approach

The HTTP Beacon and out-of-band HTTPS Netprobe requests resolved through different IP addresses. This confirms multi-routing tunnels, residential proxy rotation, or active gateway hopping.

How this helps detect bots

This signal is assessed with other independent session, browser, and network evidence. A single anomaly is a lead, not a verdict; corroborating anomalies make automated traffic more likely.

Legitimate traffic to consider

Mobile users on cellular networks where IP addresses rotate dynamically between different gateway nodes during active browsing.