There's a number of different things that these programs could be looking for in a request to determine if it's a legitimate access. Most commonly they use cookies or referrer strings. In some elaborate systems they use server-side session data. If the server determines that the request is invalid for whatever reason it can easily choose to send different data over the wire.



