Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
Browser claim vs. measured captures
A User-Agent claiming a browser the catalog has measured, at a version inside the measured range, whose TLS fingerprint is consistent with none of this site's controlled captures of that browser. Where the check above leans on an external label, this one is grounded in measurement. The comparison is layered: a fingerprint differing from a capture only in handshake-variant extensions (session resumption, 0-RTT, session tickets, padding) counts as consistent and is not shown; a differing cipher list is the stronger lead (medium); matching ciphers with a differing extension or signature-algorithm set is weaker (low) — most often a field-trial, ECH, or build variant not yet captured. It sharpens as catalog coverage broadens.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
t13d151000_8daaf6152771_18e8a06d9b2d |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 153.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 39 | 2026-08-28 | 2026-09-16 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 18 | 2026-07-22 | 2026-09-16 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome 153.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 7 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d1614h2_86a278354501_3dd24b5ebec4 |
Mozilla/5.0 (Android 10; Mobile; rv:153.0) Gecko… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 7 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d1516h3_8daaf6152771_d8a2da3f94cd |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox 155.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d1713h2_5b57614c22b0_f81080dfc557 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox 155.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 2 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d260900_6d1bcf7a4624_188c7f576dcd |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 153.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 2 | 2026-09-10 | 2026-09-15 | ||||||||||
q13d0315h3_55b375c5d22e_78345df32b3a |
Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/… | User-Agent claims Firefox 155.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 2 | 2026-09-16 | 2026-09-16 | ||||||||||
q13d0313h3_55b375c5d22e_eb028bd37c08 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 2 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d131200_f57a46bbacb6_9249cab70c77 |
Mozilla/5.0 (Linux; Android 15; SM-S918B) AppleW… | User-Agent claims Chrome 148.0.1265.105 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 1 | 2026-09-15 | 2026-09-15 | ||||||||||
t13d1517h2_8daaf6152771_3e9721a6796e |
Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/… | User-Agent claims Firefox 155.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d131100_f57a46bbacb6_ab7e3b40a677 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 26_1) App… | User-Agent claims Safari 26.1 | TLS cipher list matches no measured Safari captureThe offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 1 | 2026-09-15 | 2026-09-15 |