Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
OS claim vs. TCP stack
A User-Agent's claimed operating system against the initial TTL of its TCP SYN. An initial TTL of 64 is Unix-like (Linux, macOS, iOS, Android, BSD); 128 is Windows. A "Windows" User-Agent arriving on a TTL-64 stack — or vice versa — is inconsistent, subject to the proxy/NAT caveats above.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10948 | 2026-07-22 | 2026-09-16 | ||||||||
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 1799 | 2026-08-06 | 2026-09-16 | ||||||||
4:116+12:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … | User-Agent claims macOS | TCP SYN initial TTL 116+12 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 150 | 2026-08-01 | 2026-09-16 | ||||||||
4:54+10:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 89 | 2026-07-19 | 2026-09-15 | ||||||||
4:50+14:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 60 | 2026-09-11 | 2026-09-16 | ||||||||
4:112+16:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … | User-Agent claims macOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 41 | 2026-08-01 | 2026-09-16 | ||||||||
6:41+23:0:1340:65535,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-09-15 | 2026-09-16 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-07-01 | 2026-09-16 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-07-19 | 2026-09-16 | ||||||||
6:43+21:0:1340:65535,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-09-15 | 2026-09-16 | ||||||||
4:50+14:0:1460:mss*29,11:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-09-13 | 2026-09-16 | ||||||||
4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-30 | 2026-09-16 | ||||||||
4:49+15:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-30 | 2026-09-15 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 8 | 2026-09-11 | 2026-09-16 | ||||||||
4:47+17:0:1460:65535,9:mss,nop,nop,sok,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 7 | 2026-08-27 | 2026-09-15 | ||||||||
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 6 | 2026-08-29 | 2026-09-16 | ||||||||
6:51+13:0:1440:65535,7:mss,nop,nop,sok,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 6 | 2026-08-26 | 2026-09-15 | ||||||||
4:45+19:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 6 | 2026-07-20 | 2026-09-15 | ||||||||
4:51+13:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 6 | 2026-09-14 | 2026-09-16 | ||||||||
4:112+16:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 5 | 2026-08-17 | 2026-09-15 | ||||||||
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 4 | 2026-06-18 | 2026-09-16 | ||||||||
4:46+18:0:1460:65535,9:mss,nop,nop,sok,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 4 | 2026-08-26 | 2026-09-15 | ||||||||
4:38+26:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 38+26 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 4 | 2026-08-30 | 2026-09-16 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 4 | 2026-09-10 | 2026-09-15 | ||||||||
4:44+20:0:1460:65535,9:mss,nop,nop,sok,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 3 | 2026-09-13 | 2026-09-15 | ||||||||
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 3 | 2026-09-16 | 2026-09-16 | ||||||||
4:48+16:0:1460:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 3 | 2026-09-16 | 2026-09-16 | ||||||||
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 2 | 2026-06-11 | 2026-09-16 | ||||||||
4:50+14:0:1460:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 2 | 2026-09-16 | 2026-09-16 | ||||||||
4:42+22:0:1452:mss*44,1:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 2 | 2026-09-15 | 2026-09-15 | ||||||||
4:46+18:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 2 | 2026-09-15 | 2026-09-16 | ||||||||
6:49+15:0:1432:65535,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 2 | 2026-09-16 | 2026-09-16 | ||||||||
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 55+9 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 2 | 2026-09-10 | 2026-09-15 | ||||||||
4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Linux | TCP SYN initial TTL 116+12 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:47+17:0:1400:mss*44,8:mss,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:43+21:0:1360:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
6:50+14:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:106+22:0:1452:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 106+22 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:118+10:0:1436:mss*45,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Linux | TCP SYN initial TTL 118+10 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:50+14:0:1436:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:52+12:0:1460:mss*29,9:mss,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:120+8:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 120+8 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:52+12:0:1460:mss*44,13:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:51+13:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:43+21:0:1440:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 | ||||||||
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-15 | 2026-09-15 | ||||||||
6:53+11:0:1440:mss*30,9:mss,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
low | 1 | 2026-09-16 | 2026-09-16 |