Tycoon Returns Different Content to Bots and Browsers
Detects a single host serving materially different status codes, body sizes, or redirects to automated user agents (bots, crawlers, scanners, curl, wget, headless browsers, python, go-http) compared to normal browsers. This behavior can indicate an Adversary-in-the-Middle (AiTM) attack where the adversary is attempting to serve different content to different user agents to evade detection or deliver malicious payloads.
Splunk (SPL)
