HTTP/2 (Akamai) fingerprint contradicts User-Agent browser

net.h2_vs_ua_browser  ·  convicts

network, browserlayer
coherencecategory
3evaders caught

What it catches

Akamai h2 fingerprint (Black Hat EU 2017). v0.74.30 FP FIX (GROUNDED on real Microsoft Edge 149): predicate not_equal -> not_equal_browser, same Chromium-family fix as net.tls_vs_ua_browser — Edge's h2 stack is Chromium's (h2_browser_hint 'chrome') under an 'edge' UA, which a literal not_equal convicted. The family-aware predicate collapses edge/brave/opera/vivaldi -> chrome so a Chromium-engine UA matches the 'chrome' h2 hint; a non-Chrome h2 stack under a Chrome-family UA (httpx/curl faking Chrome) still fires.

Signals it reads

network.h2_browser_hint   browser.ua_browser

How it fires

not_equal_browser

Evaders it caught 3

Bypassed by 10

Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.

← all detections