User-Agent Analyzer
Analyze user-agent strings for bots, headless browsers, spoofing, and anomalies. Batch analysis for log files. Built for SOC analysts and security engineers.
How do I detect headless browsers from user-agent strings?
The clearest marker is the HeadlessChrome/ token, which Chrome emits by default when launched with --headless. Puppeteer and Playwright both drive Chromium and inherit that token unless the operator explicitly overrides the UA, and Playwright's Firefox and WebKit builds often ship an unmodified desktop UA that gives nothing away. Other giveaways are PhantomJS, SlimerJS, HeadlessFirefox, Electron/, splash, and Chrome-Lighthouse. Because the UA is trivially rewritten, treat its absence as no evidence at all: confirm headless with client hints (Sec-CH-UA), TLS/JA4 fingerprints, navigator.webdriver, missing Accept-Language or Accept-Encoding headers, and behavioral signals such as zero mouse movement and impossibly fast page traversal.
What does a spoofed user-agent look like?
Spoofed UAs are usually assembled by hand or by a template and break invariants that real browsers never break. Common tells: an operating system contradiction such as iPhone and Windows NT in the same string, or Android alongside Mac OS X without the 'like Mac OS X' phrasing; a browser and engine mismatch such as Safari with no AppleWebKit token, or Firefox with no Gecko token; a version that cannot exist on the claimed platform, such as Chrome 80 on Windows XP (Chrome dropped XP at version 50) or a Chrome build number above 200; an MSIE and Trident pair that never shipped together, such as MSIE 8.0 with Trident/7.0; and Mobile Safari with no iPhone, iPad, or Android token anywhere in the string. Truncated, duplicated, or reordered tokens are also strong indicators that a string was generated rather than emitted by a browser.
How can I tell if a user-agent is a security scanner?
Many scanners identify themselves honestly. Look for Shodan, CensysInspect, ZGrab, zmap, masscan, Nuclei (often as 'Nuclei - Open-source project'), Nikto, sqlmap, WPScan, Acunetix, Netsparker, OpenVAS, Nessus, and l9explore or InternetMeasurement from research crawlers. A second, larger group is raw HTTP clients: curl/, Wget/, python-requests/, Python-urllib/, Go-http-client/, Java/, libwww-perl/, HTTPie/, axios/, node-fetch/, okhttp, PostmanRuntime, and Scrapy/. Those are not malicious by themselves, but a browser-shaped page being fetched by a bare HTTP library is automation, and on a login or admin path it deserves a look. The strongest scanner signal is not the string itself: it is a single source address walking hundreds of distinct paths in a short window with a constant UA.
What is the Cobalt Strike default user-agent?
Cobalt Strike's stock HTTP and HTTPS beacon profiles have historically sent Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) — an Internet Explorer 8 on Windows 7 string that is internally consistent but essentially extinct on real networks in 2026. Seeing it in modern proxy or web logs is a high-value lead. Note two caveats: the string is set by the malleable C2 profile, so any competent operator changes it, and legacy embedded devices and old scripted clients occasionally still send it. Treat it as a pivot indicator to correlate with beaconing intervals, JA3/JA4 hashes, destination reputation, and URI patterns, not as standalone proof.