It could just as easily be configured to send a real payload if you're connecting from certain IP blocks, or if your user agent matches a certain version, etc. Advanced actors don't serve up a payload to any device that connects.