Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
Browser claim vs. tool fingerprint
A User-Agent claiming a mainstream browser, observed with a TLS ClientHello the JA4+ database identifies as a non-browser tool (curl, a C2 agent, a library). The TLS stack is far harder to forge convincingly than the User-Agent header.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 76 | 2026-07-07 | 2026-09-09 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… | User-Agent claims Chrome | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 47 | 2026-07-01 | 2026-09-02 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 26 | 2026-06-16 | 2026-09-14 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:… | User-Agent claims Firefox | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 11 | 2026-07-03 | 2026-08-31 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
visionheight.com/scan Mozilla/5.0 (Macintosh; In… | User-Agent claims visionheight.com | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 7 | 2026-06-25 | 2026-09-04 | ||||||
t13d190900_9dc949149365_97f8aa674fd9 |
Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/H… | User-Agent claims Chrome | JA4 identified as Sliver AgentThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 6 | 2026-06-17 | 2026-09-12 | ||||||
t13d191000_9dc949149365_e7c285222651 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Edge | JA4 identified as ngrokThe TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.
|
high | 5 | 2026-07-12 | 2026-08-31 |