4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.… |
User-Agent claims Linux |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | Linux |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (X11; Linux x86_64; rv:89.0) Gecko/2… |
User-Agent claims Linux |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (X11; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0.2 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | Linux |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Safari/605.1.15 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-07-10 |
2026-07-14 |
4:120+8:0:8960:mss*7,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 |
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; … |
User-Agent claims macOS |
TCP SYN initial TTL 120+8 indicates Windows
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; rv:93.0) Gecko/20100101 Firefox/93.0 |
|---|
| Observed TTL | 120+8 (observed + path distance → initial) |
|---|
| Claimed OS | macOS |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-10 |
2026-07-10 |