Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
Browser claim vs. tool fingerprint
A User-Agent claiming a mainstream browser, observed with a TLS ClientHello the JA4+ database identifies as a non-browser tool (curl, a C2 agent, a library). The TLS stack is far harder to forge convincingly than the User-Agent header.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 76 | 2026-07-07 | 2026-09-09 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 47 | 2026-07-01 | 2026-09-02 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 26 | 2026-06-16 | 2026-09-14 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 11 | 2026-07-03 | 2026-08-31 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
visionheight.com/scan Mozilla/5.0 (Macintosh; In… | User-Agent claims visionheight.com | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 7 | 2026-06-25 | 2026-09-04 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/H… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-17 | 2026-09-12 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-07-12 | 2026-08-31 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129… | User-Agent claims Firefox | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Safari | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 9; MI 8 SE Build/PKQ… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-07-23 | 2026-08-25 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0… | User-Agent claims Firefox | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G955F)… | User-Agent claims Samsung Browser | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-16 | 2026-09-16 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 11; MVK-T2101) Apple… | User-Agent claims Edge | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-16 | 2026-09-16 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-19 | 2026-08-19 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_2) Appl… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-30 | 2026-08-30 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/556.… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-30 | 2026-08-30 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) … | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-31 | 2026-08-31 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2_2) Ap… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-05 | 2026-09-05 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2) Appl… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-08 | 2026-09-08 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) Ap… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-13 | 2026-09-13 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/559.… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-08 | 2026-09-08 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWe… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-23 | 2026-08-23 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-10 | 2026-09-10 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-18 | 2026-08-18 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWe… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-23 | 2026-08-23 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Android 6.0.1; Mobile; rv:48.0) Gec… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-28 | 2026-08-28 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6; … | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-28 | 2026-08-28 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 9; ONEPLUS A5000) Ap… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-30 | 2026-08-30 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) … | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-30 | 2026-08-30 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-08-31 | 2026-08-31 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like M… | User-Agent claims Safari | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-03 | 2026-09-03 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 7.0; Alcatel_5044R) … | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-05 | 2026-09-05 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Dalvik/2.1.0 (Linux; U; Android 8.0.0; SM-A520F … | User-Agent claims Dalvik | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-09 | 2026-09-09 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/5… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-09 | 2026-09-09 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) A… | User-Agent claims Safari | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-10 | 2026-09-10 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) A… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-11 | 2026-09-11 |