4:54+10:0:1412:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 54+10 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 54+10 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
2 |
2026-08-21 |
2026-09-03 |
4:54+10:0:1412:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 54+10 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 |
|---|
| Observed TTL | 54+10 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-09-04 |
2026-09-04 |
4:54+10:0:1412:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW… |
User-Agent claims Windows |
TCP SYN initial TTL 54+10 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Kinza/6.1.5 |
|---|
| Observed TTL | 54+10 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-30 |
2026-07-30 |
4:54+10:0:1412:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 … |
User-Agent claims Windows |
TCP SYN initial TTL 54+10 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 |
|---|
| Observed TTL | 54+10 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-29 |
2026-07-29 |
4:54+10:0:1412:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 |
Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36… |
User-Agent claims Windows |
TCP SYN initial TTL 54+10 indicates Unix-like
The initial TTL is set by the sending kernel (64 on Unix-like systems, 128 on Windows) and survives NAT. But VPNs, proxies and tunnels legitimately replace the sending stack, so this check never exceeds medium confidence.
| Full User-Agent | Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36 |
|---|
| Observed TTL | 54+10 (observed + path distance → initial) |
|---|
| Claimed OS | Windows |
|---|
| Confidence | low — single sighting of an environmental signal |
|---|
|
low |
1 |
2026-07-25 |
2026-07-25 |