Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
Browser claim vs. measured captures
A User-Agent claiming a browser the catalog has measured, at a version inside the measured range, whose TLS fingerprint is consistent with none of this site's controlled captures of that browser. Where the check above leans on an external label, this one is grounded in measurement. The comparison is layered: a fingerprint differing from a capture only in handshake-variant extensions (session resumption, 0-RTT, session tickets, padding) counts as consistent and is not shown; a differing cipher list is the stronger lead (medium); matching ciphers with a differing extension or signature-algorithm set is weaker (low) — most often a field-trial, ECH, or build variant not yet captured. It sharpens as catalog coverage broadens.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
t13d1715h2_5b57614c22b0_a54fffd0eb61 |
Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/… | User-Agent claims Firefox 140.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 141 | 2026-06-11 | 2026-09-03 | ||||||||||
t13d2913h1_723694b0fccc_5671b5df5029 |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac… | User-Agent claims Chrome 150.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 138 | 2026-08-27 | 2026-08-31 | ||||||||||
t13d2913h1_723694b0fccc_5671b5df5029 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac… | User-Agent claims Chrome 150.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 128 | 2026-08-27 | 2026-08-31 | ||||||||||
t13d2913h1_723694b0fccc_5671b5df5029 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac… | User-Agent claims Firefox 153.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 127 | 2026-08-27 | 2026-08-31 | ||||||||||
t13d2913h1_723694b0fccc_5671b5df5029 |
Mozilla/5.0 (iPad; CPU OS 18_0 like Mac OS X) Ap… | User-Agent claims Firefox 153.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 82 | 2026-08-27 | 2026-08-31 | ||||||||||
t13d151000_8daaf6152771_18e8a06d9b2d |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 153.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 39 | 2026-08-28 | 2026-09-16 | ||||||||||
t13d260900_6d1bcf7a4624_188c7f576dcd |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 151.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 36 | 2026-08-03 | 2026-08-27 | ||||||||||
t13d1617h2_86a278354501_3e9721a6796e |
Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 34 | 2026-07-29 | 2026-08-31 | ||||||||||
t13d131000_f57a46bbacb6_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… | User-Agent claims Firefox 140.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 28 | 2026-06-30 | 2026-09-01 | ||||||||||
t13d1516h2_8daaf6152771_d8a2da3f94cd |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac… | User-Agent claims Safari 26.0 | TLS cipher list matches no measured Safari captureThe offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 28 | 2026-07-02 | 2026-09-03 | ||||||||||
t13d311200_e8f1e7e78f70_ccd0985badbe |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0… | User-Agent claims Firefox 134.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 26 | 2026-06-17 | 2026-09-08 | ||||||||||
t13d1616h2_86a278354501_eeeea6562960 |
Mozilla/5.0 (Android 14; Mobile; rv:153.0) Gecko… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 25 | 2026-08-20 | 2026-08-21 | ||||||||||
t12d210700_76e208dd3e22_2dae41c691ec |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 149.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 22 | 2026-07-30 | 2026-08-28 | ||||||||||
t13d2013h1_2b729b4bf6f3_e24568c0d440 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 22 | 2026-09-14 | 2026-09-14 | ||||||||||
t13d1615h2_86a278354501_a54fffd0eb61 |
Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 20 | 2026-08-20 | 2026-08-20 | ||||||||||
t13d131000_f57a46bbacb6_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133… | User-Agent claims Firefox 133.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 20 | 2026-06-11 | 2026-09-09 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 20 | 2026-08-30 | 2026-09-02 | ||||||||||
t13d1516h2_8daaf6152771_d8a2da3f94cd |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like M… | User-Agent claims Safari 26.0 | TLS cipher list matches no measured Safari captureThe offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 18 | 2026-07-01 | 2026-09-04 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 18 | 2026-07-22 | 2026-09-16 | ||||||||||
t13d1812h1_85036bcba153_b26ce05bbdd6 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 17 | 2026-09-13 | 2026-09-14 | ||||||||||
t13d131000_f57a46bbacb6_e7c285222651 |
Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/… | User-Agent claims Firefox 135.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 14 | 2026-07-25 | 2026-09-10 | ||||||||||
t13d1114h2_5e2a75874763_89e9e4bb3419 |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like M… | User-Agent claims Safari 26.0 | TLS cipher list matches no measured Safari captureThe offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 13 | 2026-07-01 | 2026-09-04 | ||||||||||
t13d1615h2_86a278354501_a54fffd0eb61 |
Mozilla/5.0 (iPad; CPU OS 18_6 like Mac OS X) Ap… | User-Agent claims Safari 26.0 | TLS cipher list matches no measured Safari captureThe offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 12 | 2026-08-20 | 2026-08-20 | ||||||||||
t13d6912h1_8b2139ff7677_4de21b5f1c9e |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 151.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 11 | 2026-08-10 | 2026-08-19 | ||||||||||
t13d1516h2_8daaf6152771_eeeea6562960 |
Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko… | User-Agent claims Firefox 154.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 10 | 2026-08-30 | 2026-08-30 | ||||||||||
t13d6913h2_8b2139ff7677_0ceea7c49f79 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 10 | 2026-09-09 | 2026-09-09 | ||||||||||
q13d0313h3_55b375c5d22e_eb028bd37c08 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 10 | 2026-07-27 | 2026-09-04 | ||||||||||
t13d2812h2_a01be8c064b6_ef4b9b248d72 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 10 | 2026-08-28 | 2026-08-28 | ||||||||||
t12d700700_b8b0f76b4bb5_4446390ac224 |
python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0… | User-Agent claims python-requests 2.6.0 | TLS cipher list matches no measured python-requests captureThe offered TLS cipher suites match no controlled capture of python-requests. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 10 | 2026-07-12 | 2026-09-04 | ||||||||||
t13d1312h2_f57a46bbacb6_ab7e3b40a677 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 9 | 2026-09-05 | 2026-09-05 | ||||||||||
t13d260900_6d1bcf7a4624_188c7f576dcd |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 151.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 9 | 2026-08-03 | 2026-08-27 | ||||||||||
t13d1516h2_8daaf6152771_eeeea6562960 |
Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko… | User-Agent claims Firefox 154.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 9 | 2026-08-20 | 2026-08-21 | ||||||||||
t13d6913h2_8b2139ff7677_0ceea7c49f79 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Safari 26.5.2 | TLS cipher list matches no measured Safari captureThe offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 9 | 2026-09-09 | 2026-09-09 | ||||||||||
t13d260900_6d1bcf7a4624_188c7f576dcd |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Edge 151.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 8 | 2026-08-21 | 2026-08-26 | ||||||||||
t13d1011h2_9a30925095c0_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 150.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 7 | 2026-08-01 | 2026-08-27 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome 153.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 7 | 2026-09-16 | 2026-09-16 | ||||||||||
q13d0314h3_55b375c5d22e_1ecea7cb6ec1 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 7 | 2026-08-10 | 2026-08-17 | ||||||||||
t13d301300_1d37bd780c83_5ae85263eb3b |
Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/… | User-Agent claims Firefox 142.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 7 | 2026-07-22 | 2026-09-13 | ||||||||||
t13d1517h2_8daaf6152771_dcad5a053991 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 151.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 7 | 2026-09-03 | 2026-09-03 | ||||||||||
t13d2012h1_2b729b4bf6f3_9e7b989ebec8 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 7 | 2026-09-13 | 2026-09-13 | ||||||||||
t13d1011h1_61a7ad8aa9b6_3a8073edd8ef |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137… | User-Agent claims Firefox 137.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 7 | 2026-07-31 | 2026-09-02 | ||||||||||
t13d1614h2_86a278354501_3dd24b5ebec4 |
Mozilla/5.0 (Android 10; Mobile; rv:153.0) Gecko… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 7 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d1515h2_8daaf6152771_a54fffd0eb61 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 6 | 2026-08-10 | 2026-08-17 | ||||||||||
t13d1516h1_8daaf6152771_33a51b5ad3c5 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132… | User-Agent claims Firefox 132.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 6 | 2026-08-22 | 2026-08-22 | ||||||||||
t12d200700_22c523c4c553_2dae41c691ec |
Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) G… | User-Agent claims Firefox 143.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 6 | 2026-06-19 | 2026-09-08 | ||||||||||
t13d1516h1_8daaf6152771_33a51b5ad3c5 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox 132.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 6 | 2026-08-22 | 2026-08-22 | ||||||||||
t13d1410h2_f98f5dc5c741_4c1ab0552904 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Edge 151.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 6 | 2026-08-26 | 2026-08-26 | ||||||||||
t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 5 | 2026-09-13 | 2026-09-14 | ||||||||||
q13d0315h3_55b375c5d22e_dc5437974b47 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 149.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 5 | 2026-08-22 | 2026-08-22 | ||||||||||
t13d1911h2_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox 155.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 5 | 2026-09-13 | 2026-09-13 | ||||||||||
q13d0315h3_55b375c5d22e_78345df32b3a |
Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/… | User-Agent claims Firefox 152.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 5 | 2026-07-06 | 2026-08-30 | ||||||||||
t13d1616h2_86a278354501_fe7c3632a08d |
Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/… | User-Agent claims Firefox 152.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 5 | 2026-07-06 | 2026-08-30 | ||||||||||
t13d691100_8b2139ff7677_4de21b5f1c9e |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154… | User-Agent claims Firefox 154.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 5 | 2026-08-26 | 2026-08-26 | ||||||||||
t13d1716h2_5b57614c22b0_ca3c9f312770 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154… | User-Agent claims Firefox 154.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 5 | 2026-08-26 | 2026-08-26 | ||||||||||
t13d1515h2_60db84cde7a9_a54fffd0eb61 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151… | User-Agent claims Firefox 151.0 | TLS cipher list matches no measured Firefox captureThe offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-09-02 | 2026-09-03 | ||||||||||
t13d251100_f5a23f7cfd7b_36bf25f296df |
Mozilla/5.0 (Windows NT 10.0; Microsoft Windows … | User-Agent claims PowerShell 7.6.5 | TLS cipher list matches no measured PowerShell captureThe offered TLS cipher suites match no controlled capture of PowerShell. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d1516h3_8daaf6152771_d8a2da3f94cd |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox 155.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d2013h1_2b729b4bf6f3_e24568c0d440 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-09-09 | 2026-09-13 | ||||||||||
q13d0314h3_55b375c5d22e_74e6e096c8e5 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-08-19 | 2026-08-19 | ||||||||||
t13d1712h1_ab0a1bf427ad_882d495ac381 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome 150.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-08-28 | 2026-09-08 | ||||||||||
t13d2013h2_a09f3c656075_7f0f34a4126d |
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/5… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d131100_f57a46bbacb6_ab7e3b40a677 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 150.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-08-12 | 2026-08-29 | ||||||||||
t13d1517h2_8daaf6152771_dcad5a053991 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 151.0.0.0 | TLS extensions or signature algorithms differ from every measured Edge captureThe cipher suites match Edge, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-08-28 | 2026-08-28 | ||||||||||
t13d1515h2_8daaf6152771_5c2c66f702b0 |
Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko… | User-Agent claims Firefox 154.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-08-30 | 2026-08-30 | ||||||||||
q13d0314h3_55b375c5d22e_1ecea7cb6ec1 |
Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/… | User-Agent claims Firefox 154.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-08-20 | 2026-08-20 | ||||||||||
t13d691200_8b2139ff7677_0ceea7c49f79 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 4 | 2026-09-09 | 2026-09-09 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 152.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 4 | 2026-09-04 | 2026-09-04 | ||||||||||
t13d1518h2_8daaf6152771_4980c97edce0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome 153.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-09-16 | 2026-09-16 | ||||||||||
t13d131100_f57a46bbacb6_ab7e3b40a677 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 151.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 3 | 2026-08-28 | 2026-09-03 | ||||||||||
q13d0315h3_55b375c5d22e_dc5437974b47 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 150.0.0.0 | TLS extensions or signature algorithms differ from every measured Chrome captureThe cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-08-27 | 2026-08-27 | ||||||||||
q13d0315h3_55b375c5d22e_78345df32b3a |
Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-07-29 | 2026-08-31 | ||||||||||
q13d0314h3_55b375c5d22e_1ecea7cb6ec1 |
Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… | User-Agent claims Firefox 153.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-08-19 | 2026-08-19 | ||||||||||
t13d260900_6d1bcf7a4624_188c7f576dcd |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome 152.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 3 | 2026-09-10 | 2026-09-10 | ||||||||||
t13d131100_f57a46bbacb6_ab7e3b40a677 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 150.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 3 | 2026-08-28 | 2026-08-28 | ||||||||||
q13d0313h3_55b375c5d22e_4effff169a46 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox 147.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-07-05 | 2026-09-01 | ||||||||||
t13d6912h2_8b2139ff7677_4de21b5f1c9e |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 151.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 3 | 2026-08-10 | 2026-08-19 | ||||||||||
t13d0911h2_e58ff226e52e_78e6aca7449b |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 151.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 3 | 2026-08-28 | 2026-08-28 | ||||||||||
t13d201100_2b729b4bf6f3_36bf25f296df |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge 149.0.0.0 | TLS cipher list matches no measured Edge captureThe offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 3 | 2026-08-08 | 2026-08-23 | ||||||||||
t13d1516h1_8daaf6152771_33a51b5ad3c5 |
Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/… | User-Agent claims Firefox 132.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-08-22 | 2026-08-22 | ||||||||||
t13d1616h2_86a278354501_eeeea6562960 |
Mozilla/5.0 (Android 14; Mobile; rv:152.0) Gecko… | User-Agent claims Firefox 152.0 | TLS extensions or signature algorithms differ from every measured Firefox captureThe cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.
|
low | 3 | 2026-08-20 | 2026-08-21 | ||||||||||
t13d2013h2_a09f3c656075_2590684db98f |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome 151.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 2 | 2026-08-22 | 2026-08-22 | ||||||||||
t13d5212h1_b262b3658495_8e6e362c5eac |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome 151.0.0.0 | TLS cipher list matches no measured Chrome captureThe offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.
|
medium | 2 | 2026-08-19 | 2026-08-19 |