Installed fonts imply an OS that contradicts the UA platform
br.font_os_vs_ua · convicts
browserlayer
coherencecategory
3evaders caught
What it catches
CreepJS / fingerprintjs: OS-specific font stacks betray a spoofed UA platform
Signals it reads
browser.font_os_hint browser.ua_platform
How it fires
not_equal
Evaders it caught 3
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.