Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
Browser claim vs. tool fingerprint
A User-Agent claiming a mainstream browser, observed with a TLS ClientHello the JA4+ database identifies as a non-browser tool (curl, a C2 agent, a library). The TLS stack is far harder to forge convincingly than the User-Agent header.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 26 | 2026-06-16 | 2026-09-14 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/H… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-17 | 2026-09-12 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129… | User-Agent claims Firefox | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims Safari | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0… | User-Agent claims Firefox | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… | User-Agent claims Firefox | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 2 | 2026-09-14 | 2026-09-15 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) A… | User-Agent claims Safari | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-10 | 2026-09-10 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) A… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-11 | 2026-09-11 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G955F)… | User-Agent claims Samsung Browser | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-16 | 2026-09-16 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 11; MVK-T2101) Apple… | User-Agent claims Edge | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-16 | 2026-09-16 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) Ap… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-13 | 2026-09-13 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
medium | 1 | 2026-09-10 | 2026-09-10 |