FIX syntax tells

Real FIX on the wire has a fingerprint:

• 8=FIX.4.x or 8=FIXT.1.1 at the start
• Fields separated by SOH (shown as | in logs)
• tag=value pairs, tag 10 checksum at the end
• Session messages are short; app messages carry 55, 38, 54…

Not FIX: JSON {"msgType":"D"}, HTTP POST /order, raw protobuf, or EUR/USD alone.

Detective rule — if you do not see 8= and 10= in the same frame, it is probably not FIX.