- Censorship bypass tools triggering destination server's firewall (suspicious TLS fingerprint or connection characteristics, or bad proxy IP)
- Bad ISP (e.g. one ISP IP address or range of addresses shared by so many users that could create collateral damage if one or more user gone rogue)
- Actual botnet/hidden residential proxy exit node on the same IP/local network (e.g. TV boxes or SDKs embedded inside apps that users are not aware of)
- Strict privacy settings (unlikely to cause 403 straight away), or obscure browsers (also unlikely, but can trigger firewall because of connection fingerprint/characteristics)
- VPN/Proxy/Datacenter IP/Tor usage
- Censorship bypass tools triggering destination server's firewall (suspicious TLS fingerprint or connection characteristics, or bad proxy IP)
- Bad ISP (e.g. one ISP IP address or range of addresses shared by so many users that could create collateral damage if one or more user gone rogue)
- Actual botnet/hidden residential proxy exit node on the same IP/local network (e.g. TV boxes or SDKs embedded inside apps that users are not aware of)
- Strict privacy settings (unlikely to cause 403 straight away), or obscure browsers (also unlikely, but can trigger firewall because of connection fingerprint/characteristics)
- Actual bad behavior (scraping, etc)