Anomalies

Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).

OS claim vs. TCP stack

A User-Agent's claimed operating system against the initial TTL of its TCP SYN. An initial TTL of 64 is Unix-like (Linux, macOS, iOS, Android, BSD); 128 is Windows. A "Windows" User-Agent arriving on a TTL-64 stack — or vice versa — is inconsistent, subject to the proxy/NAT caveats above.

fingerprintUser-Agentclaimswire showsconfidenceseenfirst seenlast seen
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 56+8 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler))
Observed TTL56+8 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 10948 2026-07-22 2026-09-16
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler))
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 1799 2026-08-06 2026-09-16
4:116+12:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … User-Agent claims macOS
TCP SYN initial TTL 116+12 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)
Observed TTL116+12 (observed + path distance → initial)
Claimed OSmacOS
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 150 2026-08-01 2026-09-16
4:54+10:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 54+10 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Observed TTL54+10 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 89 2026-07-19 2026-09-15
4:50+14:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 50+14 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Observed TTL50+14 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 60 2026-09-11 2026-09-16
4:112+16:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … User-Agent claims macOS
TCP SYN initial TTL 112+16 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)
Observed TTL112+16 (observed + path distance → initial)
Claimed OSmacOS
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 41 2026-08-01 2026-09-16
6:41+23:0:1340:65535,8:mss,nop,ws,nop,nop,sok:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 41+23 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Observed TTL41+23 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 36 2026-09-15 2026-09-16
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 47+17 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Observed TTL47+17 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 25 2026-07-01 2026-09-16
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 51+13 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Observed TTL51+13 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 23 2026-07-19 2026-09-16
6:43+21:0:1340:65535,8:mss,nop,ws,nop,nop,sok:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 43+21 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Observed TTL43+21 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 19 2026-09-15 2026-09-16
4:50+14:0:1460:mss*29,11:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 50+14 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Observed TTL50+14 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 14 2026-09-13 2026-09-16
4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 11 2026-08-30 2026-09-16
4:49+15:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 49+15 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36
Observed TTL49+15 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 10 2026-07-30 2026-09-15
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… User-Agent claims Android
TCP SYN initial TTL 121+7 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Observed TTL121+7 (observed + path distance → initial)
Claimed OSAndroid
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 8 2026-09-11 2026-09-16
4:47+17:0:1460:65535,9:mss,nop,nop,sok,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 47+17 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Observed TTL47+17 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 7 2026-08-27 2026-09-15
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 52+12 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Observed TTL52+12 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 6 2026-08-29 2026-09-16
6:51+13:0:1440:65535,7:mss,nop,nop,sok,nop,ws:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 51+13 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Observed TTL51+13 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 6 2026-08-26 2026-09-15
4:45+19:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 45+19 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Observed TTL45+19 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 6 2026-07-20 2026-09-15
4:51+13:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 51+13 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203
Observed TTL51+13 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 6 2026-09-14 2026-09-16
4:112+16:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims macOS
TCP SYN initial TTL 112+16 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Observed TTL112+16 (observed + path distance → initial)
Claimed OSmacOS
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 5 2026-08-17 2026-09-15
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 44+20 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Observed TTL44+20 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 4 2026-06-18 2026-09-16
4:46+18:0:1460:65535,9:mss,nop,nop,sok,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 46+18 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Observed TTL46+18 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 4 2026-08-26 2026-09-15
4:38+26:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 38+26 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36
Observed TTL38+26 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 4 2026-08-30 2026-09-16
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… User-Agent claims Android
TCP SYN initial TTL 121+7 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.7977.82 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Observed TTL121+7 (observed + path distance → initial)
Claimed OSAndroid
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 4 2026-09-10 2026-09-15
4:44+20:0:1460:65535,9:mss,nop,nop,sok,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 44+20 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Observed TTL44+20 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 3 2026-09-13 2026-09-15
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… User-Agent claims Windows
TCP SYN initial TTL 44+20 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Observed TTL44+20 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 3 2026-09-16 2026-09-16
4:48+16:0:1460:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 48+16 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Observed TTL48+16 (observed + path distance → initial)
Claimed OSWindows
Confidencemedium — repeated co-occurrence, but initial TTL is environmental — capped at medium
medium 3 2026-09-16 2026-09-16
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.… User-Agent claims Windows
TCP SYN initial TTL 46+18 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;
Observed TTL46+18 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 2 2026-06-11 2026-09-16
4:50+14:0:1460:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 50+14 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Observed TTL50+14 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 2 2026-09-16 2026-09-16
4:42+22:0:1452:mss*44,1:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 42+22 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Observed TTL42+22 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 2 2026-09-15 2026-09-15
4:46+18:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 46+18 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Observed TTL46+18 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 2 2026-09-15 2026-09-16
6:49+15:0:1432:65535,8:mss,nop,ws,nop,nop,sok:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 49+15 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Observed TTL49+15 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 2 2026-09-16 2026-09-16
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 55+9 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Observed TTL55+9 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 2 2026-09-10 2026-09-15
4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Linux
TCP SYN initial TTL 116+12 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Observed TTL116+12 (observed + path distance → initial)
Claimed OSLinux
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.2817.206 Safari/537.36; compatible; GrokBot/1.0; +https://x.ai/grokbot
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:47+17:0:1400:mss*44,8:mss,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 47+17 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0
Observed TTL47+17 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:43+21:0:1360:65535,6:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 43+21 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Observed TTL43+21 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
6:50+14:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 50+14 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Observed TTL50+14 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:106+22:0:1452:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims macOS
TCP SYN initial TTL 106+22 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Observed TTL106+22 (observed + path distance → initial)
Claimed OSmacOS
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:118+10:0:1436:mss*45,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… User-Agent claims Linux
TCP SYN initial TTL 118+10 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Observed TTL118+10 (observed + path distance → initial)
Claimed OSLinux
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 48+16 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Observed TTL48+16 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:50+14:0:1436:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 50+14 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Observed TTL50+14 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:52+12:0:1460:mss*29,9:mss,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107… User-Agent claims Windows
TCP SYN initial TTL 52+12 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Observed TTL52+12 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129… User-Agent claims Windows
TCP SYN initial TTL 48+16 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
Observed TTL48+16 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 48+16 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0
Observed TTL48+16 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:120+8:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … User-Agent claims macOS
TCP SYN initial TTL 120+8 indicates Windows

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
Observed TTL120+8 (observed + path distance → initial)
Claimed OSmacOS
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:52+12:0:1460:mss*44,13:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 52+12 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.47
Observed TTL52+12 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.6807.218 Safari/537.36; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot) Chrome/109.0.6761.140 Safari/537.36
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:51+13:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126… User-Agent claims Windows
TCP SYN initial TTL 51+13 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0
Observed TTL51+13 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:43+21:0:1440:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 43+21 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Observed TTL43+21 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Discordbot/2.0; +https://discordapp.com) Chrome/122.0.4946.140 Safari/537.36
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
4:58+6:0:1420:mss*30,9:mss,sok,ts,nop,ws:df,id+:0 Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleW… User-Agent claims Windows
TCP SYN initial TTL 58+6 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot) Chrome/109.0.287.15 Safari/537.36 Edg/109.0.287.15
Observed TTL58+6 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-15 2026-09-15
6:53+11:0:1440:mss*30,9:mss,nop,ws:flow:0 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108… User-Agent claims Windows
TCP SYN initial TTL 53+11 indicates Unix-like

The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.

Full User-AgentMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
Observed TTL53+11 (observed + path distance → initial)
Claimed OSWindows
Confidencelow — single sighting of an environmental signal
low 1 2026-09-16 2026-09-16

How confidence is assigned