If the TCP Window size is abnormally small I block those and MSS outside of 1280-1460 but that is prior to anything the browser is doing. Those can been seen with
tcpdump -p -i any -c512 -NNnnvv port 443 and 'tcp[13] == 2'
Or if a VPN is being used there is always a chance it is coming from a server/VPS provider and may be blackhole routed on my end.
