4:108+20:0:1432:mss*44,8:mss,nop,ws,nop,nop,sok:id-:0 |
Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleW… |
User-Agent claims Android |
TCP SYN initial TTL 108+20 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36 |
|---|
| Observed TTL | 108+20 (observed + path distance → initial) |
|---|
| Claimed OS | Android |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-08-31 |
2026-08-31 |
4:108+20:0:1432:mss*44,8:mss,nop,ws,nop,nop,sok:id-:0 |
Mozilla/5.0 (Linux; Android 14; Pixel 9) AppleWe… |
User-Agent claims Android |
TCP SYN initial TTL 108+20 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Linux; Android 14; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36 |
|---|
| Observed TTL | 108+20 (observed + path distance → initial) |
|---|
| Claimed OS | Android |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-08-27 |
2026-08-27 |