Anomalies

Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).

Browser claim vs. tool fingerprint

A User-Agent claiming a mainstream browser, observed with a TLS ClientHello the JA4+ database identifies as a non-browser tool (curl, a C2 agent, a library). The TLS stack is far harder to forge convincingly than the User-Agent header.

fingerprintUser-Agentclaimswire showsconfidenceseenfirst seenlast seen
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like M… User-Agent claims Safari
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 2062 2026-06-11 2026-08-06
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 … User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 81 2026-06-14 2026-06-14
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 76 2026-07-07 2026-09-09
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Linux; Android 11; vivo 1906; wv) A… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 11; vivo 1906; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/87.0.4280.141 Mobile Safari/537.36 VivoBrowser/8.9.0.0
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 65 2026-06-27 2026-08-03
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 47 2026-07-01 2026-09-02
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 34 2026-06-27 2026-08-03
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 26 2026-06-16 2026-09-14
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:… User-Agent claims Firefox
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 11 2026-07-03 2026-08-31
t13d190900_9dc949149365_97f8aa674fd9 visionheight.com/scan Mozilla/5.0 (Macintosh; In… User-Agent claims visionheight.com
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-Agentvisionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 7 2026-06-25 2026-09-04
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleW… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Safari
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132… User-Agent claims Firefox
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/H… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) MicroMessenger Weixin QQ AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.62 XWEB/2692 MMWEBSDK/200901 Mobile Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-17 2026-09-12
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133… User-Agent claims Firefox
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac… User-Agent claims Safari
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/… User-Agent claims Firefox
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 6 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 5 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 5 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 5 2026-06-25 2026-06-25
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 5 2026-06-25 2026-06-25
t13d191000_9dc949149365_e7c285222651 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Edge
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 5 2026-07-12 2026-08-31
t13d191000_9dc949149365_e7c285222651 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/… User-Agent claims Chrome
JA4 identified as ngrok

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Label distributionngrok
Confidencehigh — repeated co-occurrence
high 4 2026-08-03 2026-08-03
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) A… User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 3 2026-07-27 2026-07-27
t13d190900_9dc949149365_97f8aa674fd9 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) … User-Agent claims Chrome
JA4 identified as Sliver Agent

The TLS ClientHello is produced by the client's TLS library and is far harder to forge than a User-Agent header. This fingerprint's dominant community label is a non-browser tool, so the browser claim contradicts the wire.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.62 Safari/537.36
Label distributionSliver Agent
Confidencehigh — repeated co-occurrence
high 3 2026-07-01 2026-07-01

How confidence is assigned