missing-browser-headers
Standard browser headers absent (Accept, Accept-Language, etc.)
send-time-anomaly
Traffic sent at off-hours with no human plausibility
http-method-anomaly
Destructive method (DELETE/PUT) as first request, or probing with HEAD/OPTIONS
suspicious-accept
Accept header pattern inconsistent with browser requests
header-order-anomaly
Request headers in alphabetical or non-browser order