4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-24 |
2026-07-24 |
4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWe… |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-27 |
2026-07-27 |
4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.41 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-20 |
2026-07-20 |
4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/… |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 ADG/11.0.2566 AOLBUILD/11.0.2566 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-24 |
2026-07-24 |
4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-23 |
2026-07-23 |
4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWe… |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-21 |
2026-07-21 |
4:51+13:0:1404:65535,6:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 … |
User-Agent claims Windows |
TCP SYN initial TTL 51+13 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1467.0 Safari/537.36 |
|---|
| Observed TTL | 51+13 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-27 |
2026-07-27 |