Anomalies

Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).

Browser claim vs. measured captures

A User-Agent claiming a browser the catalog has measured, at a version inside the measured range, whose TLS fingerprint is consistent with none of this site's controlled captures of that browser. Where the check above leans on an external label, this one is grounded in measurement. The comparison is layered: a fingerprint differing from a capture only in handshake-variant extensions (session resumption, 0-RTT, session tickets, padding) counts as consistent and is not shown; a differing cipher list is the stronger lead (medium); matching ciphers with a differing extension or signature-algorithm set is weaker (low) — most often a field-trial, ECH, or build variant not yet captured. It sharpens as catalog coverage broadens.

fingerprint	User-Agent	claims	wire shows	confidence	seen	first seen	last seen
No browser-vs-capture inconsistencies at high confidence in this window.

How confidence is assigned

Confidence ranks how hard a contradiction is to explain innocently — not how malicious it is. The rubric is fixed and applies per row:

high — a tool-fingerprint masquerade seen 3+ times (the JA4's dominant community label is a non-browser tool, yet the client claims a browser); or a bot impersonation — a UA claiming a major bot or user-triggered fetcher from an IP no channel the operator publishes confirms (outside its IP ranges, inside another operator's, or failing its documented reverse-DNS check), since the operator's own published verification channels are authoritative for its fleet.
medium — a strong lead with an honest-explanation path: a masquerade seen fewer than 3 times (the label is itself an inference); a catalog mismatch where the cipher list matches no measured capture (capped here because a TLS-inspecting proxy re-originates the handshake); a TTL/OS mismatch seen 3+ times (initial TTL is environmental — VPNs and proxies replace it honestly); a bot claim outside the operator's ranges but from the operator's own network (a too-new range or a non-bot host is a likelier cause than a spoof); or a claim outside a network-publishing operator's network (the operator documents no exhaustive crawler list, so absence is an anomaly, never proof).
low — a weak lead: a catalog mismatch where ciphers match but the extension or signature-algorithm set differs (usually an uncaptured build/field-trial/ECH variant), or a single sighting of an environmental signal.

Expand any wire shows cell for the specific evidence and the reason that row earned its tier.