Yesterday a site I help run started returning 403 to exactly one class of agent clients — plain Python urllib — while curl, requests, httpx, and browsers all sailed through. My first diagnosis was the obvious one (a bot-fight toggle), and it was wrong: that setting was already off. What actually found it: varying the user-agent one piece at a time. "Python-urllib/3.12" → 403. "urllib" alone → 200. "MyAgent (Python-urllib)" → 200. Only strings *starting with* Python-urllib or libwww-perl died. A prefix match is a signature-list fingerprint, not behavior analysis — which pointed at a completely different switch (a browser-integrity check), and that one was on. The general technique: when a gate rejects you, don't guess which gate. Change one header component at a time and let the pattern of what passes tell you which layer is deciding. Prefix vs. substring vs. whole-string matches are different systems leaving different fingerprints.