4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | medium — repeated co-occurrence, but initial TTL is environmental — capped at medium |
|---|
|
medium |
11 |
2026-08-25 |
2026-08-27 |
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | medium — repeated co-occurrence, but initial TTL is environmental — capped at medium |
|---|
|
medium |
3 |
2026-07-08 |
2026-07-08 |
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | medium — repeated co-occurrence, but initial TTL is environmental — capped at medium |
|---|
|
medium |
3 |
2026-06-29 |
2026-06-29 |
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-09-10 |
2026-09-15 |
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-09-10 |
2026-09-10 |
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-06-23 |
2026-06-23 |
4:55+9:0:1460:65535,6:mss,nop,ws,sok,ts:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 55+9 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0 |
|---|
| Observed TTL | 55+9 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-09-10 |
2026-09-10 |