Anomalies

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of python-requests. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

This User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Perplexity-User, but the connection's IP is outside the ranges Perplexity-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims ClaudeBot, but the connection's IP is outside the ranges ClaudeBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Perplexity-User, but the connection's IP is outside the ranges Perplexity-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amzn-SearchBot, but the connection's IP is outside the ranges Amzn-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims ClaudeBot, but the connection's IP is outside the ranges ClaudeBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Perplexity-User, but the connection's IP is outside the ranges Perplexity-User publishes for its fetcher, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Googlebot, but the connection's IP is outside the ranges Googlebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Googlebot, but the connection's IP is outside the ranges Googlebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amzn-SearchBot, but the connection's IP is outside the ranges Amzn-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Bingbot, but the connection's IP is outside the ranges Bingbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims DuckDuckBot, but the connection's IP is outside the ranges DuckDuckBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims CCBot, but the connection's IP is outside the ranges CCBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims ClaudeBot, but the connection's IP is outside the ranges ClaudeBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims YandexBot. No usable published-range snapshot covered the claim at ingest, and the reverse-DNS check the operator documents completed without confirming it — no PTR record, no name in the operator's rDNS space, or a name that failed forward confirmation. With no operator-published channel vouching for the IP, this is an impersonation signal.

This User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Applebot, but the connection's IP is outside the ranges Applebot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims DuckAssistBot, but the connection's IP is outside the ranges DuckAssistBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Bingbot, but the connection's IP is outside the ranges Bingbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims GPTBot, but the connection's IP is outside the ranges GPTBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amzn-SearchBot, but the connection's IP is outside the ranges Amzn-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims CCBot, but the connection's IP is outside the ranges CCBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims OAI-SearchBot, but the connection's IP is outside the ranges OAI-SearchBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims PerplexityBot, but the connection's IP is outside the ranges PerplexityBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims CCBot, but the connection's IP is outside the ranges CCBot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims Amazonbot, but the connection's IP is outside the ranges Amazonbot publishes for its crawler, and no other operator-published channel confirms it. An IP no channel vouches for is almost always an impersonator — honest exceptions (a brand-new range not yet in our snapshot, or a proxy relaying a real fetch) are rare, and claims the operator's reverse DNS does confirm are excluded here (they surface as publication disagreements on the operator's page, not as impersonations).

This User-Agent claims YandexBot. No usable published-range snapshot covered the claim at ingest, and the reverse-DNS check the operator documents completed without confirming it — no PTR record, no name in the operator's rDNS space, or a name that failed forward confirmation. With no operator-published channel vouching for the IP, this is an impersonation signal.