How-to
UA Rotation Detector
Detect bots cycling through many browser versions to evade detection.
What it detects
Catches bots cycling through many different browser versions. A legitimate user population clusters sharply on the latest one or two versions of each browser (plus a small tail of stragglers). A bot rotating its user-agent string presents Chrome 116, 117, 118, 119, 120 in comparable shares from a single network, a distribution real users never produce.
How it works
Every minute, the detector counts distinct browser versions per network and compares the spread against the threshold. It measures version churn rather than raw user-agent string diversity, so cosmetic string variations don't inflate the count.
Default state
Ships disabled. Version-churn thresholds vary with how diverse your legitimate audience is, so validate against your own traffic first: check the User-agent versions panel on a few busy ASN detail pages to see your normal spread, then enable the rule from the Rules page.
Default thresholds
| Parameter | Default | Description |
|---|---|---|
window_minutes | 10 | Evaluation window |
distinct_ua_threshold | 15 | Minimum distinct versions to trip |
min_requests | 5,000 | Volume floor |
Severity
- Warning: distinct versions exceed threshold
- Critical: distinct versions exceed 2× the threshold
Related
- The Stale Browser Anomaly detector covers the complementary signature: meaningful volume claiming to be a browser version real users abandoned long ago. See How Detectors Work.