What it detects01
What does 'Structured Custom Header Set' indicate?
It indicates the domain returns a small but deliberate set of custom HTTP headers, which is typical of sites running on maintained hosting rather than a bare, unconfigured server.
Structured Custom Header Set
It indicates the domain returns a small but deliberate set of custom HTTP headers, which is typical of sites running on maintained hosting rather than a bare, unconfigured server.
Also surfaces as:
Rich Custom Header SetManaged Platform Header Fingerprint
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
What does 'Rich Custom Header Set' indicate?
It indicates a broad set of custom headers covering caching, request tracing and delivery metadata. Producing and maintaining these headers requires operational effort that short-lived abusive infrastructure rarely invests in.
How analysts use it03
What does 'Managed Platform Header Fingerprint' mean?
It means the response carries the dense, coherent header set emitted by a managed hosting or commerce platform such as a large storefront provider, site builder or enterprise CDN, where the platform operator controls the response and enforces its own abuse policies.
Worth knowing04
How should SOC analysts interpret this label?
Treat it as a de-risking signal whose strength grows with the sublabel. Measurement across phishing, malware, spam and compromised-site populations shows domains with four or more custom headers are cleaner than the crawled baseline, and domains with sixteen or more are close to two orders of magnitude cleaner. It does not clear a domain on its own: a malicious page can be hosted on a managed platform, so weigh it against active malicious findings rather than letting it override them.
Evidence shape
What Structured Custom Header Set looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "http_custom_header_fingerprint",
"name": "Structured Custom Header Set",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "safe",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}Siblings
Peers in HTTP Header Behaviors
12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
CDN Fronted
It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security pro…
SafeCore
Basic Enterprise Stack
It indicates that the domain is running on a recognized enterprise or managed infrastructure stack, such as well-known a…
Safe
Basic Profiling Cookie Risk
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
MaliciousCore
Parked Domain Infrastructure
The response does not come from a real site but from a domain parking, for-sale or traffic monetization platform: a park…
MaliciousCore
In the wild
See Structured Custom Header Set fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.