It indicates that the web server instructs the browser to reload the page automatically through an HTTP Refresh response header, without user interaction. The instruction comes from the server response rather than the page content.
The questions every analyst asks before acting on this signal.
It indicates that the web server instructs the browser to reload the page automatically through an HTTP Refresh response header, without user interaction. The instruction comes from the server response rather than the page content.
Both describe the same behavior but originate from different layers. The meta tag variant is declared inside the HTML document, while this one arrives as an HTTP header. Separating them shows which layer carries the instruction, which matters when the page body looks clean but the server still forces a refresh.
A refresh set at the server layer applies before page content is evaluated and is invisible in the page source, so it is harder to notice. Attackers use it to delay redirection to malicious destinations or to keep a foothold page cycling until a payload is ready.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "auto_page_refresh_with_header",
"name": "Suspicious Auto Page Refresh Activity (HTTP Header)",
"group": "http_crawling_history",
"subgroup": "web_behavior_structure",
"direction": "malicious",
"evidence": {
"url_shortener_chain": false,
"auto_refresh_seconds": null,
"direct_ip_link": false,
"browser_interaction_required": true
}
}9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain or web page automatically reloads itself after a certain interval without user interaction.…
An injected iframe refers to an HTML frame embedded within a web page that loads content from an external or malicious d…
It refers to the automatic forwarding of a user or system request from one domain to another destination. Redirects can …
It refers to the action of accessing a resource using a direct IP address instead of a domain name. Threat actors often …
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.