Anomalies

Where a client's self-declaration disagrees with what its connection actually proved at the wire. A User-Agent is a claim anyone can set; the TLS, TCP, and HTTP/2 fingerprints below are measured from the bytes. Disagreement is the classic signal of automation dressed as a browser — though VPNs, proxies, privacy tools, and shared fingerprints produce honest mismatches too, so these are leads, not verdicts. Each check scans every co-observed pairing on record (showing one check, capped at 500 rows).

OS claim vs. TCP stack

A User-Agent's claimed operating system against the initial TTL of its TCP SYN. An initial TTL of 64 is Unix-like (Linux, macOS, iOS, Android, BSD); 128 is Windows. A "Windows" User-Agent arriving on a TTL-64 stack — or vice versa — is inconsistent, subject to the proxy/NAT caveats above.

fingerprint	User-Agent	claims	wire shows	confidence	seen	first seen	last seen
No OS-vs-TCP inconsistencies at high confidence in this window.

How confidence is assigned

Confidence ranks how hard a contradiction is to explain innocently — not how malicious it is. The rubric is fixed and applies per row:

high — a tool-fingerprint masquerade seen 3+ times (the JA4's dominant community label is a non-browser tool, yet the client claims a browser); or a bot impersonation — a UA claiming a major bot or user-triggered fetcher from an IP no channel the operator publishes confirms (outside its IP ranges, inside another operator's, or failing its documented reverse-DNS check), since the operator's own published verification channels are authoritative for its fleet.
medium — a strong lead with an honest-explanation path: a masquerade seen fewer than 3 times (the label is itself an inference); a catalog mismatch where the cipher list matches no measured capture (capped here because a TLS-inspecting proxy re-originates the handshake); a TTL/OS mismatch seen 3+ times (initial TTL is environmental — VPNs and proxies replace it honestly); a bot claim outside the operator's ranges but from the operator's own network (a too-new range or a non-bot host is a likelier cause than a spoof); or a claim outside a network-publishing operator's network (the operator documents no exhaustive crawler list, so absence is an anomaly, never proof).
low — a weak lead: a catalog mismatch where ciphers match but the extension or signature-algorithm set differs (usually an uncaptured build/field-trial/ECH variant), or a single sighting of an environmental signal.

Expand any wire shows cell for the specific evidence and the reason that row earned its tier.