Anomalies

Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).

Browser claim vs. tool fingerprint

A User-Agent claiming a mainstream browser, observed with a TLS ClientHello the JA4+ database identifies as a non-browser tool (curl, a C2 agent, a library). The TLS stack is far harder to forge convincingly than the User-Agent header.

fingerprintUser-Agentclaimswire showsconfidenceseenfirst seenlast seen
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 26 2026-06-16 2026-09-14
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/H… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) MicroMessenger Weixin QQ AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.62 XWEB/2692 MMWEBSDK/200901 Mobile Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-17 2026-09-12
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129… User-Agent claims Firefox
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Safari
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0… User-Agent claims Firefox
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:129.0) Gecko/20100101 Firefox/129.0
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv… User-Agent claims Firefox
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 2 2026-09-14 2026-09-15
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) A… User-Agent claims Safari
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13+ (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2
Label distributionSliver Agent
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 1 2026-09-10 2026-09-10
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) A… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36
Label distributionSliver Agent
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 1 2026-09-11 2026-09-11
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-G955F)… User-Agent claims Samsung Browser
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 9; SAMSUNG SM-G955F) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/16.2 Chrome/92.0.4515.166 Mobile Safari/537.36
Label distributionSliver Agent
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 1 2026-09-16 2026-09-16
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Linux; Android 11; MVK-T2101) Apple… User-Agent claims Edge
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 11; MVK-T2101) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.116 Safari/537.36 EdgA/45.09.4.5083
Label distributionSliver Agent
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 1 2026-09-16 2026-09-16
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) Ap… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit/586.35 (KHTML, like Gecko) Chrome/64.0.2256 Safari/537.36
Label distributionngrok
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 1 2026-09-13 2026-09-13
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Label distributionSliver Agent
Confidencemedium — fewer than 3 sightings; the label is itself an inference
medium 1 2026-09-10 2026-09-10

How confidence is assigned