api-reconnaissance
Systematic API spec or endpoint discovery pattern
send-time-anomaly
Traffic sent at off-hours with no human plausibility
suspicious-accept
Accept header pattern inconsistent with browser requests
header-order-anomaly
Request headers in alphabetical or non-browser order