Anomalies
Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).
OS claim vs. TCP stack
A User-Agent's claimed operating system against the initial TTL of its TCP SYN. An initial TTL of 64 is Unix-like (Linux, macOS, iOS, Android, BSD); 128 is Windows. A "Windows" User-Agent arriving on a TTL-64 stack — or vice versa — is inconsistent, subject to the proxy/NAT caveats above.
| fingerprint | User-Agent | claims | wire shows | confidence | seen | first seen | last seen | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10948 | 2026-07-22 | 2026-09-16 | ||||||||
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 2726 | 2026-07-01 | 2026-09-16 | ||||||||
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 1799 | 2026-08-06 | 2026-09-16 | ||||||||
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 1764 | 2026-07-03 | 2026-09-16 | ||||||||
6:42+22:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 1692 | 2026-08-03 | 2026-09-16 | ||||||||
6:41+23:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 1063 | 2026-08-03 | 2026-09-16 | ||||||||
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 942 | 2026-07-25 | 2026-09-15 | ||||||||
4:55+9:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 55+9 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 449 | 2026-08-03 | 2026-09-16 | ||||||||
6:55+9:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 55+9 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 438 | 2026-08-06 | 2026-08-30 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 407 | 2026-07-11 | 2026-08-27 | ||||||||
6:53+11:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 362 | 2026-08-03 | 2026-09-16 | ||||||||
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 358 | 2026-08-03 | 2026-09-16 | ||||||||
6:46+18:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 356 | 2026-08-03 | 2026-09-16 | ||||||||
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 210 | 2026-08-03 | 2026-09-16 | ||||||||
4:116+12:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … | User-Agent claims macOS | TCP SYN initial TTL 116+12 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 151 | 2026-08-01 | 2026-09-16 | ||||||||
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 144 | 2026-07-25 | 2026-09-05 | ||||||||
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 144 | 2026-08-06 | 2026-09-14 | ||||||||
4:49+15:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 108 | 2026-07-29 | 2026-09-10 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 95 | 2026-06-25 | 2026-09-13 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 11; moto g power (20… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 91 | 2026-06-25 | 2026-09-13 | ||||||||
4:54+10:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 91 | 2026-07-19 | 2026-09-16 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 78 | 2026-08-26 | 2026-09-09 | ||||||||
4:50+14:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 60 | 2026-09-11 | 2026-09-16 | ||||||||
4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 58 | 2026-08-20 | 2026-08-21 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 53 | 2026-08-21 | 2026-09-15 | ||||||||
4:56+8:0:1460:mss*29,11:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 49 | 2026-08-25 | 2026-09-10 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 48 | 2026-08-21 | 2026-09-15 | ||||||||
4:49+15:0:1400:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 48 | 2026-07-28 | 2026-09-10 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 46 | 2026-08-26 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 46 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 45 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 43 | 2026-08-21 | 2026-09-11 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 42 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 42 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 42 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 41 | 2026-08-21 | 2026-09-15 | ||||||||
4:112+16:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … | User-Agent claims macOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 41 | 2026-08-01 | 2026-09-16 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 41 | 2026-08-21 | 2026-09-15 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 41 | 2026-08-18 | 2026-08-25 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 40 | 2026-08-21 | 2026-09-15 | ||||||||
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 40 | 2026-07-01 | 2026-09-11 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 40 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 40 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 39 | 2026-08-21 | 2026-09-15 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 39 | 2026-08-29 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 39 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 39 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 38 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 37 | 2026-07-05 | 2026-09-15 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 37 | 2026-08-26 | 2026-09-15 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 37 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1410:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 37 | 2026-06-30 | 2026-09-09 | ||||||||
6:41+23:0:1340:65535,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-09-15 | 2026-09-16 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-08-21 | 2026-09-14 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-07-24 | 2026-09-11 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 36 | 2026-08-21 | 2026-09-15 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 35 | 2026-07-01 | 2026-09-13 | ||||||||
4:57+7:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 57+7 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 35 | 2026-07-08 | 2026-09-09 | ||||||||
4:56+8:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 35 | 2026-09-08 | 2026-09-11 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 35 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 35 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 34 | 2026-08-21 | 2026-09-15 | ||||||||
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 34 | 2026-07-26 | 2026-09-02 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 34 | 2026-08-21 | 2026-09-15 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 34 | 2026-07-30 | 2026-09-15 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 34 | 2026-08-21 | 2026-09-15 | ||||||||
4:54+10:0:1460:mss*29,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 33 | 2026-08-21 | 2026-09-01 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 33 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 33 | 2026-08-21 | 2026-09-09 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 32 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 32 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 32 | 2026-08-21 | 2026-09-11 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 32 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 32 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 32 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 31 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 31 | 2026-07-05 | 2026-09-10 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 31 | 2026-08-21 | 2026-09-10 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 31 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1360:mss*48,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 31 | 2026-07-07 | 2026-08-22 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 31 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-07-30 | 2026-09-11 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-09 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-09 | ||||||||
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-10 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-22 | 2026-09-15 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-10 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 30 | 2026-08-21 | 2026-09-09 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-09 | ||||||||
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-26 | 2026-09-15 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-11 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-07-29 | 2026-09-15 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-08 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-10 | ||||||||
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-07-25 | 2026-08-31 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 29 | 2026-08-21 | 2026-09-07 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 28 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 28 | 2026-08-21 | 2026-09-09 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 28 | 2026-07-29 | 2026-09-15 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 28 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 28 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 27 | 2026-08-21 | 2026-09-08 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 27 | 2026-08-21 | 2026-09-15 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 27 | 2026-08-21 | 2026-09-05 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 27 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 27 | 2026-08-21 | 2026-09-05 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-15 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-09 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-22 | 2026-09-15 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-07-05 | 2026-09-08 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-11 | ||||||||
4:115+13:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) … | User-Agent claims macOS | TCP SYN initial TTL 115+13 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-07-31 | 2026-09-15 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1360:mss*48,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-07-08 | 2026-08-22 | ||||||||
4:49+15:0:1410:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-06-30 | 2026-09-09 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-11 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-26 | 2026-09-15 | ||||||||
6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-06 | 2026-09-02 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 26 | 2026-08-21 | 2026-09-08 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-08 | ||||||||
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-10 | ||||||||
4:51+13:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-09 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-15 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-07-30 | 2026-09-09 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 25 | 2026-07-01 | 2026-09-16 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-26 | 2026-09-13 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-07-05 | 2026-09-09 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-21 | 2026-09-15 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-17 | 2026-08-18 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-21 | 2026-09-11 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-21 | 2026-09-09 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-21 | 2026-09-15 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-08-21 | 2026-09-09 | ||||||||
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 24 | 2026-07-25 | 2026-09-15 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-05 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-09 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-07-06 | 2026-08-30 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-09 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-11 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-07-05 | 2026-09-08 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-09 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1460:35844,0:mss,?34,nop,nop:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-09-02 | 2026-09-06 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-07-19 | 2026-09-16 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-09 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-15 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-11 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 23 | 2026-08-21 | 2026-09-07 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-09 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-07-29 | 2026-09-15 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-09 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-15 | ||||||||
4:43+21:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-09 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-07-30 | 2026-09-09 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-12 | ||||||||
4:45+19:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-10 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-11 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-09 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-17 | 2026-08-18 | ||||||||
6:52+12:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-07-01 | 2026-08-26 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 22 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-21 | 2026-09-10 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-21 | 2026-09-15 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-21 | 2026-09-08 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-21 | 2026-09-07 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-26 | 2026-09-15 | ||||||||
6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-07-25 | 2026-08-31 | ||||||||
4:55+9:0:1460:mss*29,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 55+9 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-25 | 2026-08-27 | ||||||||
4:56+8:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-06-25 | 2026-09-09 | ||||||||
4:43+21:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 … | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-07-01 | 2026-09-02 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-07-14 | 2026-09-11 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-21 | 2026-09-07 | ||||||||
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 21 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-15 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-17 | 2026-08-18 | ||||||||
4:50+14:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-09 | ||||||||
4:46+18:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-11 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-29 | 2026-09-11 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-07-30 | 2026-09-08 | ||||||||
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-06-19 | 2026-08-30 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-07-29 | 2026-09-15 | ||||||||
4:43+21:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-07-01 | 2026-09-02 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-17 | 2026-08-18 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-13 | ||||||||
4:56+8:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-06-25 | 2026-09-09 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-07-29 | 2026-09-15 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-08-21 | 2026-09-15 | ||||||||
4:52+12:0:1460:mss*20,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 20 | 2026-09-05 | 2026-09-05 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-07 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-08 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-07-29 | 2026-09-10 | ||||||||
4:47+17:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-08 | ||||||||
4:52+12:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-08 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-17 | 2026-08-18 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-06-17 | 2026-09-08 | ||||||||
6:43+21:0:1340:65535,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-09-15 | 2026-09-16 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-30 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-30 | 2026-09-15 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 19 | 2026-08-21 | 2026-09-11 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-07-29 | 2026-09-15 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-08 | ||||||||
4:48+16:0:1400:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-03 | 2026-08-31 | ||||||||
4:52+12:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-10 | ||||||||
4:50+14:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-09-03 | 2026-09-15 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-09 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-18 | 2026-08-18 | ||||||||
4:48+16:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-10 | ||||||||
4:46+18:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-26 | 2026-09-15 | ||||||||
4:48+16:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-05 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-09 | ||||||||
4:46+18:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-06-19 | 2026-09-15 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-17 | 2026-08-18 | ||||||||
4:43+21:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-21 | 2026-09-09 | ||||||||
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-08-20 | 2026-08-26 | ||||||||
4:51+13:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 18 | 2026-06-30 | 2026-09-01 | ||||||||
4:50+14:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-15 | ||||||||
4:43+21:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-05 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-10 | ||||||||
4:44+20:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-09 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-17 | 2026-08-18 | ||||||||
4:47+17:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-06-19 | 2026-09-16 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-08 | ||||||||
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-07-30 | 2026-08-28 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-09 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-15 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/5… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-07-28 | 2026-09-08 | ||||||||
4:47+17:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-08 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-09 | ||||||||
4:43+21:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-09 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-17 | 2026-08-18 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-21 | 2026-09-09 | ||||||||
4:51+13:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 17 | 2026-08-26 | 2026-09-15 | ||||||||
4:43+21:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-08 | ||||||||
4:52+12:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-15 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-26 | 2026-09-15 | ||||||||
4:42+22:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-08 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-09 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-09 | ||||||||
4:43+21:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-15 | ||||||||
4:43+21:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-10 | ||||||||
4:49+15:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-10 | ||||||||
4:43+21:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-26 | 2026-09-10 | ||||||||
4:44+20:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-07-29 | 2026-09-11 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-09 | ||||||||
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-15 | ||||||||
4:52+12:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 16 | 2026-08-21 | 2026-09-13 | ||||||||
4:51+13:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-26 | 2026-09-15 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-09 | ||||||||
4:43+21:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-11 | ||||||||
4:120+8:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 120+8 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-12 | 2026-09-07 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-09 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-09 | ||||||||
4:48+16:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-26 | 2026-09-15 | ||||||||
4:49+15:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-05 | ||||||||
4:52+12:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-09 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-11 | ||||||||
4:48+16:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-10 | ||||||||
4:43+21:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-08 | ||||||||
4:43+21:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-08-21 | 2026-09-10 | ||||||||
6:48+16:0:1420:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 15 | 2026-09-01 | 2026-09-01 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-30 | 2026-09-15 | ||||||||
4:50+14:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-26 | 2026-09-15 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-06-20 | 2026-09-11 | ||||||||
4:44+20:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-15 | ||||||||
6:55+9:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 55+9 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-17 | 2026-08-17 | ||||||||
4:44+20:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-09 | ||||||||
4:42+22:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-09-02 | 2026-09-09 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-10 | ||||||||
4:51+13:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1460:mss*29,11:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-09-13 | 2026-09-16 | ||||||||
4:52+12:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-08 | ||||||||
4:48+16:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-08 | ||||||||
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-10 | ||||||||
4:45+19:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-05 | ||||||||
4:44+20:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-30 | 2026-09-05 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-13 | ||||||||
4:44+20:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-08 | ||||||||
4:42+22:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-09-04 | 2026-09-13 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-09 | ||||||||
4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-20 | 2026-08-20 | ||||||||
4:42+22:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-08-21 | 2026-09-15 | ||||||||
4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 116+12 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 14 | 2026-07-13 | 2026-09-01 | ||||||||
4:50+14:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-26 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-09 | ||||||||
4:50+14:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-09 | ||||||||
4:44+20:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-05 | ||||||||
4:43+21:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-31 | 2026-09-09 | ||||||||
4:44+20:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-15 | ||||||||
4:49+15:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-07-25 | 2026-09-09 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-17 | 2026-08-18 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-07-23 | 2026-09-09 | ||||||||
4:52+12:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-12 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-13 | 2026-09-15 | ||||||||
4:44+20:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-09 | ||||||||
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-09 | ||||||||
4:44+20:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-07-05 | 2026-09-05 | ||||||||
4:43+21:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-07-05 | 2026-09-05 | ||||||||
6:47+17:0:1420:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-09-01 | 2026-09-01 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-09-02 | 2026-09-15 | ||||||||
4:50+14:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-05 | ||||||||
4:42+22:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-13 | ||||||||
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-27 | 2026-08-31 | ||||||||
4:49+15:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-10 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-20 | 2026-08-21 | ||||||||
4:44+20:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-15 | ||||||||
4:41+23:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-07-29 | 2026-09-08 | ||||||||
4:48+16:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-11 | ||||||||
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWe… | User-Agent claims Android | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-27 | 2026-08-31 | ||||||||
4:43+21:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-31 | 2026-09-15 | ||||||||
4:52+12:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 13 | 2026-08-21 | 2026-09-11 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-09-01 | 2026-09-15 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-26 | 2026-09-14 | ||||||||
4:52+12:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-26 | 2026-09-15 | ||||||||
4:50+14:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-15 | ||||||||
4:119+9:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Linux | TCP SYN initial TTL 119+9 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-09 | 2026-09-09 | ||||||||
4:113+15:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Linux | TCP SYN initial TTL 113+15 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-09-08 | 2026-09-09 | ||||||||
4:51+13:0:1452:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-10 | ||||||||
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-27 | 2026-08-30 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-09 | ||||||||
4:43+21:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-08 | ||||||||
4:47+17:0:1300:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-20 | 2026-08-20 | ||||||||
4:117+11:0:1460:mss*44,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … | User-Agent claims macOS | TCP SYN initial TTL 117+11 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-07-08 | 2026-09-07 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-30 | 2026-09-10 | ||||||||
4:58+6:0:1460:62727,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-28 | 2026-09-03 | ||||||||
4:50+14:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-31 | 2026-09-15 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-08 | ||||||||
4:48+16:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-15 | ||||||||
4:43+21:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-15 | ||||||||
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-29 | 2026-09-05 | ||||||||
4:47+17:0:1460:1152,0:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-20 | 2026-08-21 | ||||||||
4:53+11:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-10 | ||||||||
4:114+14:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 114+14 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-27 | 2026-08-31 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-09 | ||||||||
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-28 | 2026-08-31 | ||||||||
4:48+16:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-15 | ||||||||
6:48+16:0:1440:mss*45,7:mss,nop,nop,sok,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-07-26 | 2026-09-06 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-30 | 2026-09-10 | ||||||||
4:51+13:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-26 | 2026-09-09 | ||||||||
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-07-15 | 2026-08-27 | ||||||||
4:46+18:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-21 | 2026-09-09 | ||||||||
4:51+13:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 12 | 2026-08-31 | 2026-09-15 | ||||||||
4:52+12:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-05 | ||||||||
4:114+14:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWe… | User-Agent claims Android | TCP SYN initial TTL 114+14 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-27 | 2026-08-30 | ||||||||
4:53+11:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-15 | ||||||||
4:47+17:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-15 | ||||||||
4:43+21:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-30 | 2026-09-08 | ||||||||
4:52+12:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-09-02 | 2026-09-15 | ||||||||
4:47+17:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-26 | 2026-09-07 | ||||||||
4:50+14:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-05 | ||||||||
4:43+21:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-04 | ||||||||
4:53+11:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-15 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-11 | ||||||||
4:47+17:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-30 | 2026-09-13 | ||||||||
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-08 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-17 | 2026-08-18 | ||||||||
4:51+13:0:1410:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-06-25 | 2026-09-14 | ||||||||
4:42+22:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-08 | ||||||||
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-08 | ||||||||
6:48+16:0:1420:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-09-01 | 2026-09-01 | ||||||||
4:43+21:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-05 | ||||||||
4:48+16:0:1400:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-07-23 | 2026-09-10 | ||||||||
4:58+6:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 58+6 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-30 | 2026-09-16 | ||||||||
4:51+13:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-26 | 2026-09-15 | ||||||||
4:48+16:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-13 | ||||||||
4:42+22:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-08 | ||||||||
4:44+20:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-09-02 | 2026-09-05 | ||||||||
4:47+17:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-15 | ||||||||
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-15 | ||||||||
4:44+20:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-07-29 | 2026-09-05 | ||||||||
4:47+17:0:1460:65535,3:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-20 | 2026-08-20 | ||||||||
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 55+9 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-25 | 2026-08-27 | ||||||||
4:113+15:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_3 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 113+15 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-27 | 2026-08-30 | ||||||||
4:53+11:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-21 | 2026-09-08 | ||||||||
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-09-01 | 2026-09-13 | ||||||||
4:111+17:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 111+17 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-27 | 2026-08-29 | ||||||||
6:52+12:0:1440:mss*45,7:mss,nop,nop,sok,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-13 | 2026-09-14 | ||||||||
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 11 | 2026-08-28 | 2026-09-14 | ||||||||
4:50+14:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-11 | ||||||||
4:49+15:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-30 | 2026-09-15 | ||||||||
4:47+17:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-30 | 2026-09-05 | ||||||||
4:50+14:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-17 | 2026-08-18 | ||||||||
4:50+14:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-23 | 2026-08-18 | ||||||||
4:43+21:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-31 | 2026-09-05 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-15 | ||||||||
4:44+20:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-15 | ||||||||
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… | User-Agent claims Linux | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-27 | 2026-08-30 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-17 | 2026-08-18 | ||||||||
4:46+18:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:42+22:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-10 | ||||||||
4:48+16:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-09 | ||||||||
4:50+14:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-17 | 2026-08-18 | ||||||||
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-04 | ||||||||
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-06-11 | 2026-09-16 | ||||||||
4:52+12:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-05 | ||||||||
4:54+10:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-09-07 | 2026-09-07 | ||||||||
4:41+23:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-26 | 2026-09-07 | ||||||||
4:42+22:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-30 | 2026-09-05 | ||||||||
4:49+15:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-09-02 | 2026-09-09 | ||||||||
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:50+14:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-04 | ||||||||
4:43+21:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-05 | ||||||||
4:44+20:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:53+11:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-09 | ||||||||
4:41+23:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:112+16:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 112+16 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-29 | 2026-08-31 | ||||||||
4:48+16:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-09 | ||||||||
4:51+13:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-09 | ||||||||
4:56+8:0:1460:mss*29,11:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 56+8 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-11 | 2026-09-10 | ||||||||
4:51+13:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:53+11:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-05 | ||||||||
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-28 | 2026-09-15 | ||||||||
4:48+16:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-30 | 2026-09-10 | ||||||||
4:41+23:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-15 | ||||||||
4:57+7:0:1460:mss*15,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 57+7 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-24 | 2026-08-24 | ||||||||
4:113+15:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (Linux; Android 13; SM-S918B) AppleW… | User-Agent claims Android | TCP SYN initial TTL 113+15 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-29 | 2026-08-30 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-08 | ||||||||
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0 |
Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Buil… | User-Agent claims Android | TCP SYN initial TTL 121+7 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-09-11 | 2026-09-16 | ||||||||
4:52+12:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-07 | ||||||||
4:45+19:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-05 | ||||||||
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-05 | ||||||||
4:113+15:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 113+15 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-28 | 2026-08-31 | ||||||||
4:45+19:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-11 | ||||||||
4:49+15:0:1410:mss*46,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-05 | 2026-09-06 | ||||||||
6:54+10:0:1440:mss*45,7:mss,nop,nop,sok,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-09 | 2026-09-14 | ||||||||
4:47+17:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-21 | 2026-09-11 | ||||||||
4:114+14:0:1460:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 114+14 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-27 | 2026-08-31 | ||||||||
4:49+15:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-06-30 | 2026-09-01 | ||||||||
4:43+21:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-08-31 | 2026-09-11 | ||||||||
4:51+13:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-06-12 | 2026-09-08 | ||||||||
4:42+22:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 10 | 2026-07-30 | 2026-09-15 | ||||||||
4:54+10:0:1460:32768,10:mss,nop,ws,sok,ts::0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-17 | 2026-08-18 | ||||||||
4:47+17:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-04 | ||||||||
4:49+15:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-05 | ||||||||
4:44+20:0:1424:59220,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-28 | 2026-09-15 | ||||||||
4:48+16:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-15 | ||||||||
4:45+19:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-09 | ||||||||
4:53+11:0:1380:mss*47,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-09-14 | 2026-09-14 | ||||||||
4:48+16:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-26 | 2026-09-10 | ||||||||
4:52+12:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-15 | ||||||||
4:53+11:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-15 | ||||||||
4:41+23:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-05 | ||||||||
4:47+17:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-30 | 2026-09-08 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-08 | ||||||||
4:53+11:0:1380:mss*47,10:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 53+11 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-09-14 | 2026-09-14 | ||||||||
4:50+14:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-26 | 2026-09-09 | ||||||||
4:47+17:0:1452:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 47+17 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-05 | ||||||||
4:46+18:0:1460:mss*44,9:mss,nop,nop,sok,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-17 | 2026-08-18 | ||||||||
4:45+19:0:1420:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-11 | ||||||||
4:46+18:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 46+18 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-09 | ||||||||
4:44+20:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-31 | 2026-09-05 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-30 | 2026-09-08 | ||||||||
4:52+12:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 52+12 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-08 | ||||||||
4:50+14:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-11 | ||||||||
4:51+13:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 51+13 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-09 | ||||||||
4:45+19:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 45+19 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-07 | ||||||||
4:42+22:0:1412:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-09 | ||||||||
6:48+16:0:1440:65535,7:mss,nop,nop,sok,nop,ws:flow:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-09 | 2026-09-15 | ||||||||
4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac… | User-Agent claims iOS | TCP SYN initial TTL 116+12 indicates WindowsThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-07-19 | 2026-09-01 | ||||||||
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 48+16 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-08 | ||||||||
4:42+22:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 42+22 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-05 | ||||||||
4:44+20:0:1452:mss*4,4:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 44+20 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-09-02 | 2026-09-05 | ||||||||
4:43+21:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 43+21 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-05 | ||||||||
4:49+15:0:1460:65535,8:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 49+15 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-09-02 | 2026-09-11 | ||||||||
4:54+10:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 54+10 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-09-02 | 2026-09-15 | ||||||||
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-26 | 2026-09-05 | ||||||||
4:50+14:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-09 | ||||||||
4:41+23:0:1400:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 41+23 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-08-21 | 2026-09-09 | ||||||||
4:50+14:0:1460:35844,0:mss,?34,nop,nop:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… | User-Agent claims Windows | TCP SYN initial TTL 50+14 indicates Unix-likeThe initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
|
medium | 9 | 2026-09-02 | 2026-09-07 |