Anomalies

Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).

Browser claim vs. measured captures

A User-Agent claiming a browser the catalog has measured, at a version inside the measured range, whose TLS fingerprint is consistent with none of this site's controlled captures of that browser. Where the check above leans on an external label, this one is grounded in measurement. The comparison is layered: a fingerprint differing from a capture only in handshake-variant extensions (session resumption, 0-RTT, session tickets, padding) counts as consistent and is not shown; a differing cipher list is the stronger lead (medium); matching ciphers with a differing extension or signature-algorithm set is weaker (low) — most often a field-trial, ECH, or build variant not yet captured. It sharpens as catalog coverage broadens.

fingerprintUser-Agentclaimswire showsconfidenceseenfirst seenlast seen
t13d1715h2_5b57614c22b0_a54fffd0eb61 Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/… User-Agent claims Firefox 140.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Claimed version140.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 141 2026-06-11 2026-09-03
t13d2913h1_723694b0fccc_5671b5df5029 Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac… User-Agent claims Chrome 150.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1
Claimed version150.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 138 2026-08-27 2026-08-31
t13d2913h1_723694b0fccc_5671b5df5029 Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac… User-Agent claims Chrome 150.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1
Claimed version150.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 128 2026-08-27 2026-08-31
t13d2913h1_723694b0fccc_5671b5df5029 Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac… User-Agent claims Firefox 153.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/153.0 Mobile/15E148 Safari/604.1
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 127 2026-08-27 2026-08-31
t13d2913h1_723694b0fccc_5671b5df5029 Mozilla/5.0 (iPad; CPU OS 18_0 like Mac OS X) Ap… User-Agent claims Firefox 153.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPad; CPU OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/153.0 Mobile/15E148 Safari/604.1
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 82 2026-08-27 2026-08-31
t13d151000_8daaf6152771_18e8a06d9b2d Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 153.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Claimed version153.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 39 2026-08-28 2026-09-16
t13d260900_6d1bcf7a4624_188c7f576dcd Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 151.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Claimed version151.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 36 2026-08-03 2026-08-27
t13d1617h2_86a278354501_3e9721a6796e Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 34 2026-07-29 2026-08-31
t13d131000_f57a46bbacb6_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… User-Agent claims Firefox 140.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Claimed version140.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 28 2026-06-30 2026-09-01
t13d1516h2_8daaf6152771_d8a2da3f94cd Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac… User-Agent claims Safari 26.0
TLS cipher list matches no measured Safari capture

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1
Claimed version26.0
Measured versions26.5, 26.5.2, 26.6.1, 26.4, 26.6.2
Layercipher suites differ
JA4 labelunlabeled
medium 28 2026-07-02 2026-09-03
t13d311200_e8f1e7e78f70_ccd0985badbe Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0… User-Agent claims Firefox 134.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0
Claimed version134.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 26 2026-06-17 2026-09-08
t13d1616h2_86a278354501_eeeea6562960 Mozilla/5.0 (Android 14; Mobile; rv:153.0) Gecko… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Android 14; Mobile; rv:153.0) Gecko/153.0 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 25 2026-08-20 2026-08-21
t12d210700_76e208dd3e22_2dae41c691ec Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 149.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0
Claimed version149.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 22 2026-07-30 2026-08-28
t13d2013h1_2b729b4bf6f3_e24568c0d440 Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/152.0.0.0
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 22 2026-09-14 2026-09-14
t13d1615h2_86a278354501_a54fffd0eb61 Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 20 2026-08-20 2026-08-20
t13d131000_f57a46bbacb6_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133… User-Agent claims Firefox 133.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Claimed version133.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 20 2026-06-11 2026-09-09
t13d1518h2_8daaf6152771_4980c97edce0 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome 152.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 20 2026-08-30 2026-09-02
t13d1516h2_8daaf6152771_d8a2da3f94cd Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like M… User-Agent claims Safari 26.0
TLS cipher list matches no measured Safari capture

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1
Claimed version26.0
Measured versions26.5, 26.5.2, 26.6.1, 26.4, 26.6.2
Layercipher suites differ
JA4 labelunlabeled
medium 18 2026-07-01 2026-09-04
t13d1518h2_8daaf6152771_4980c97edce0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 18 2026-07-22 2026-09-16
t13d1812h1_85036bcba153_b26ce05bbdd6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 17 2026-09-13 2026-09-14
t13d131000_f57a46bbacb6_e7c285222651 Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/… User-Agent claims Firefox 135.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0
Claimed version135.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 14 2026-07-25 2026-09-10
t13d1114h2_5e2a75874763_89e9e4bb3419 Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like M… User-Agent claims Safari 26.0
TLS cipher list matches no measured Safari capture

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1
Claimed version26.0
Measured versions26.5, 26.5.2, 26.6.1, 26.4, 26.6.2
Layercipher suites differ
JA4 labelunlabeled
medium 13 2026-07-01 2026-09-04
t13d1615h2_86a278354501_a54fffd0eb61 Mozilla/5.0 (iPad; CPU OS 18_6 like Mac OS X) Ap… User-Agent claims Safari 26.0
TLS cipher list matches no measured Safari capture

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (iPad; CPU OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1
Claimed version26.0
Measured versions26.5, 26.5.2, 26.6.1, 26.4, 26.6.2
Layercipher suites differ
JA4 labelunlabeled
medium 12 2026-08-20 2026-08-20
t13d6912h1_8b2139ff7677_4de21b5f1c9e Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 151.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 11 2026-08-10 2026-08-19
t13d1516h2_8daaf6152771_eeeea6562960 Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko… User-Agent claims Firefox 154.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0
Claimed version154.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 10 2026-08-30 2026-08-30
t13d6913h2_8b2139ff7677_0ceea7c49f79 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 10 2026-09-09 2026-09-09
q13d0313h3_55b375c5d22e_eb028bd37c08 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 152.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 10 2026-07-27 2026-09-04
t13d2812h2_a01be8c064b6_ef4b9b248d72 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 10 2026-08-28 2026-08-28
t12d700700_b8b0f76b4bb5_4446390ac224 python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0… User-Agent claims python-requests 2.6.0
TLS cipher list matches no measured python-requests capture

The offered TLS cipher suites match no controlled capture of python-requests. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-Agentpython-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64
Claimed version2.6.0
Measured versions2.34.2, 2.33.1, 2.32.3
Layercipher suites differ
JA4 labelunlabeled
medium 10 2026-07-12 2026-09-04
t13d1312h2_f57a46bbacb6_ab7e3b40a677 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 9 2026-09-05 2026-09-05
t13d260900_6d1bcf7a4624_188c7f576dcd Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 151.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 9 2026-08-03 2026-08-27
t13d1516h2_8daaf6152771_eeeea6562960 Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko… User-Agent claims Firefox 154.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0
Claimed version154.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 9 2026-08-20 2026-08-21
t13d6913h2_8b2139ff7677_0ceea7c49f79 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Safari 26.5.2
TLS cipher list matches no measured Safari capture

The offered TLS cipher suites match no controlled capture of Safari. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15
Claimed version26.5.2
Measured versions26.5, 26.5.2, 26.6.1, 26.4, 26.6.2
Layercipher suites differ
JA4 labelunlabeled
medium 9 2026-09-09 2026-09-09
t13d260900_6d1bcf7a4624_188c7f576dcd Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Edge 151.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 8 2026-08-21 2026-08-26
t13d1011h2_9a30925095c0_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 150.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Claimed version150.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 7 2026-08-01 2026-08-27
t13d1518h2_8daaf6152771_4980c97edce0 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome 153.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Claimed version153.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 7 2026-09-16 2026-09-16
q13d0314h3_55b375c5d22e_1ecea7cb6ec1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 7 2026-08-10 2026-08-17
t13d301300_1d37bd780c83_5ae85263eb3b Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/… User-Agent claims Firefox 142.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0
Claimed version142.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 7 2026-07-22 2026-09-13
t13d1517h2_8daaf6152771_dcad5a053991 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 151.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Claimed version151.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 7 2026-09-03 2026-09-03
t13d2012h1_2b729b4bf6f3_9e7b989ebec8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 7 2026-09-13 2026-09-13
t13d1011h1_61a7ad8aa9b6_3a8073edd8ef Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137… User-Agent claims Firefox 137.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0
Claimed version137.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 7 2026-07-31 2026-09-02
t13d1614h2_86a278354501_3dd24b5ebec4 Mozilla/5.0 (Android 10; Mobile; rv:153.0) Gecko… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Android 10; Mobile; rv:153.0) Gecko/153.0 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 7 2026-09-16 2026-09-16
t13d1515h2_8daaf6152771_a54fffd0eb61 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 6 2026-08-10 2026-08-17
t13d1516h1_8daaf6152771_33a51b5ad3c5 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132… User-Agent claims Firefox 132.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0
Claimed version132.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 6 2026-08-22 2026-08-22
t12d200700_22c523c4c553_2dae41c691ec Mozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) G… User-Agent claims Firefox 143.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; rv:143.0) Gecko/20100101 Firefox/143.0
Claimed version143.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 6 2026-06-19 2026-09-08
t13d1516h1_8daaf6152771_33a51b5ad3c5 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… User-Agent claims Firefox 132.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Claimed version132.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 6 2026-08-22 2026-08-22
t13d1410h2_f98f5dc5c741_4c1ab0552904 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Edge 151.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 6 2026-08-26 2026-08-26
t13d3112h2_e8f1e7e78f70_b26ce05bbdd6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/152.0.0.0
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 5 2026-09-13 2026-09-14
q13d0315h3_55b375c5d22e_dc5437974b47 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 149.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Claimed version149.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 5 2026-08-22 2026-08-22
t13d1911h2_9dc949149365_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… User-Agent claims Firefox 155.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0
Claimed version155.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 5 2026-09-13 2026-09-13
q13d0315h3_55b375c5d22e_78345df32b3a Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/… User-Agent claims Firefox 152.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0
Claimed version152.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 5 2026-07-06 2026-08-30
t13d1616h2_86a278354501_fe7c3632a08d Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/… User-Agent claims Firefox 152.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0
Claimed version152.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 5 2026-07-06 2026-08-30
t13d691100_8b2139ff7677_4de21b5f1c9e Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154… User-Agent claims Firefox 154.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0
Claimed version154.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 5 2026-08-26 2026-08-26
t13d1716h2_5b57614c22b0_ca3c9f312770 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154… User-Agent claims Firefox 154.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0
Claimed version154.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 5 2026-08-26 2026-08-26
t13d1515h2_60db84cde7a9_a54fffd0eb61 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151… User-Agent claims Firefox 151.0
TLS cipher list matches no measured Firefox capture

The offered TLS cipher suites match no controlled capture of Firefox. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0
Claimed version151.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-09-02 2026-09-03
t13d251100_f5a23f7cfd7b_36bf25f296df Mozilla/5.0 (Windows NT 10.0; Microsoft Windows … User-Agent claims PowerShell 7.6.5
TLS cipher list matches no measured PowerShell capture

The offered TLS cipher suites match no controlled capture of PowerShell. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.26200; ru-RU) PowerShell/7.6.5
Claimed version7.6.5
Measured versions7.6.4, 7.6.3, 7.6.5, 5.1.26100.33296, 5.1.26100.32995, 5.1.26100.33158
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-09-16 2026-09-16
t13d1516h3_8daaf6152771_d8a2da3f94cd Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… User-Agent claims Firefox 155.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0
Claimed version155.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 4 2026-09-16 2026-09-16
t13d2013h1_2b729b4bf6f3_e24568c0d440 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-09-09 2026-09-13
q13d0314h3_55b375c5d22e_74e6e096c8e5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 4 2026-08-19 2026-08-19
t13d1712h1_ab0a1bf427ad_882d495ac381 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome 150.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Claimed version150.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-08-28 2026-09-08
t13d2013h2_a09f3c656075_7f0f34a4126d Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/5… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-09-16 2026-09-16
t13d131100_f57a46bbacb6_ab7e3b40a677 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 150.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Claimed version150.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-08-12 2026-08-29
t13d1517h2_8daaf6152771_dcad5a053991 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 151.0.0.0
TLS extensions or signature algorithms differ from every measured Edge capture

The cipher suites match Edge, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 4 2026-08-28 2026-08-28
t13d1515h2_8daaf6152771_5c2c66f702b0 Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko… User-Agent claims Firefox 154.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0
Claimed version154.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 4 2026-08-30 2026-08-30
q13d0314h3_55b375c5d22e_1ecea7cb6ec1 Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/… User-Agent claims Firefox 154.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Claimed version154.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 4 2026-08-20 2026-08-20
t13d691200_8b2139ff7677_0ceea7c49f79 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 4 2026-09-09 2026-09-09
t13d1518h2_8daaf6152771_4980c97edce0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 152.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 4 2026-09-04 2026-09-04
t13d1518h2_8daaf6152771_4980c97edce0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome 153.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Claimed version153.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-09-16 2026-09-16
t13d131100_f57a46bbacb6_ab7e3b40a677 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 151.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Claimed version151.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 3 2026-08-28 2026-09-03
q13d0315h3_55b375c5d22e_dc5437974b47 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 150.0.0.0
TLS extensions or signature algorithms differ from every measured Chrome capture

The cipher suites match Chrome, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Claimed version150.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-08-27 2026-08-27
q13d0315h3_55b375c5d22e_78345df32b3a Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-07-29 2026-08-31
q13d0314h3_55b375c5d22e_1ecea7cb6ec1 Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/… User-Agent claims Firefox 153.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0
Claimed version153.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-08-19 2026-08-19
t13d260900_6d1bcf7a4624_188c7f576dcd Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome 152.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Claimed version152.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 3 2026-09-10 2026-09-10
t13d131100_f57a46bbacb6_ab7e3b40a677 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 150.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0
Claimed version150.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 3 2026-08-28 2026-08-28
q13d0313h3_55b375c5d22e_4effff169a46 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… User-Agent claims Firefox 147.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0
Claimed version147.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-07-05 2026-09-01
t13d6912h2_8b2139ff7677_4de21b5f1c9e Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 151.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 3 2026-08-10 2026-08-19
t13d0911h2_e58ff226e52e_78e6aca7449b Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 151.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0
Claimed version151.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 3 2026-08-28 2026-08-28
t13d201100_2b729b4bf6f3_36bf25f296df Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge 149.0.0.0
TLS cipher list matches no measured Edge capture

The offered TLS cipher suites match no controlled capture of Edge. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0
Claimed version149.0.0.0
Measured versions152.0.4191.66, 151.0.4129.72, 149.0.4022.98, 151.0.4129.101, 150.0.4078.65, 149.0.4022.69, 149.0.4022.52, 150.0.4078.99, 149.0.4022.80, 151.0.4129.93, 151.0.4129.59
Layercipher suites differ
JA4 labelunlabeled
medium 3 2026-08-08 2026-08-23
t13d1516h1_8daaf6152771_33a51b5ad3c5 Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/… User-Agent claims Firefox 132.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0
Claimed version132.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-08-22 2026-08-22
t13d1616h2_86a278354501_eeeea6562960 Mozilla/5.0 (Android 14; Mobile; rv:152.0) Gecko… User-Agent claims Firefox 152.0
TLS extensions or signature algorithms differ from every measured Firefox capture

The cipher suites match Firefox, but the extension set or signature algorithms differ from every capture even after normalizing handshake-variant extensions. Most likely a field-trial, ECH, or build variant the catalog has not captured; occasionally mimicry. This sharpens as catalog coverage grows.

Full User-AgentMozilla/5.0 (Android 14; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
Claimed version152.0
Measured versions146.0.1, 152.0.1, 154.0, 140.0.2, 151.0.4, 151.0.2, 139.0, 153.0.1, 155.0, 152.0.5, 153.0.3, 142.0.1, 153.0.4, 152.0.6, 150.0.2, 135.0, 132.0, 152.0.3, 148.0.2, 137.0, 141.0, 155.0.1, 153.0, 151.0.3, 144.0.2, 154.0.1, 134.0, 152.0.4, 151.0
Layercipher suites match; extension set or signature algorithms differ
JA4 labelunlabeled
low 3 2026-08-20 2026-08-21
t13d2013h2_a09f3c656075_2590684db98f Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome 151.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Claimed version151.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 2 2026-08-22 2026-08-22
t13d5212h1_b262b3658495_8e6e362c5eac Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome 151.0.0.0
TLS cipher list matches no measured Chrome capture

The offered TLS cipher suites match no controlled capture of Chrome. Cipher lists are very stable per browser, so a different one is a real inconsistency — though a TLS-inspecting proxy re-originating the handshake is an honest cause, which holds this at medium.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Claimed version151.0.0.0
Measured versions151.0.7922.174, 149.0.7827.103, 149.0.7827.53, 149.0.7827.115, 149.0.7827.114, 153.0.8010.47, 149.0.7827.54, 149.0.7827.201, 150.0.7871.187, 153.0.8010.36, 151.0.7922.170, 152.0.7977.83, 152.0.7977.82, 152.0.7977.65, 150.0.7871.114, 150.0.7871.115, 150.0.7871.129, 151.0.7922.72, 151.0.7922.137, 152.0.7977.75, 151.0.7922.173, 149.0.7827.102, 149.0.7827.156, 151.0.7922.71, 150.0.7871.128, 151.0.7922.108, 149.0.7827.155, 150.0.7871.125, 150.0.7871.46, 151.0.7922.109, 152.0.7977.64, 148.0.7778.179, 149.0.7827.200
Layercipher suites differ
JA4 labelunlabeled
medium 2 2026-08-19 2026-08-19

How confidence is assigned