Threat UA Switcher

Threat UA Switcher is a Firefox Desktop extension for defensive security research, threat intelligence investigations, cloaking analysis, QA, and web compatibility testing.

It lets researchers quickly change the User-Agent reported by Firefox. Profiles can be applied to a single tab or globally across all tabs. The extension rewrites the HTTP User-Agent header and aligns selected JavaScript properties, including navigator.userAgent, platform, vendor, mobile indicators, and User-Agent Client Hints where possible.

Included profiles cover current mobile and desktop browsers, Windows and ClickFix-related clients, command-line tools, crawlers, legacy browsers, and custom User-Agent strings.

An optional X-Forwarded-For header can be configured for testing applications that trust client-supplied forwarding information. For safety, this header is sent only to the exact hostname where it was configured and never to subdomains, CDNs, or third-party hosts. It does not change the real network source address or provide actual geographic routing.

User-Agent spoofing cannot reproduce a complete browser or device fingerprint. Rendering engines, TLS characteristics, WebGL, fonts, viewport behavior, and other signals may still reveal Firefox. Managed bot challenges such as Cloudflare may reject an inconsistent browser identity.

Threat UA Switcher does not collect or transmit user data, includes no telemetry, makes no extension-initiated network requests, and uses no external dependencies.

For safe analysis of potentially malicious websites, use the extension inside a dedicated Firefox profile or an isolated virtual machine without personal credentials.