Looks at the remnant clues such as attributes around the browser session for traces of malware, anomalous on-page behavior, faked domains and app ids, deceptive placement handling by malicious publishers and mobile botnets that convincingly, but imperfectly, mimic legitimate traffic.