User-Agent Rotation - Possible Nuclei Random-Agent

Bryant Smith@flowstate

•updated Mar 23, 2026•4•0•104

Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei '-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by using a different, valid browser User-Agent string for each request.