TCP/IP-stack OS kernel contradicts the OS the User-Agent claims

net.tcp_os_vs_ua  ·  convicts

networklayer
coherencecategory
19evaders caught

What it catches

p0f-style SYN fingerprint; the kernel a stack reveals can't be changed by a UA spoof (Android→linux, iOS→darwin)

Signals it reads

network.tcp_kernel   network.ua_kernel

How it fires

not_equal

Evaders it caught 19

azuretls camoufox camoufox-macos ch-ua-hardcoded curl-http2 firefox-os-spoof font-os-leak http2-naive ios-ua-spoof mobile-no-touch os-spoof playwright-extra primp stealth-patched tls-stale-template ua-rotation vanilla webkit-safari-coherent webkit-ua-spoof

Bypassed by 10

Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.

camoufox-hardened camoufox-hardened-behave camoufox-headful camoufox-linux camoufox-linux-coherent camoufox-socks-webrtc patchright-headful webrtc-leak zendriver-uach zendriver-uach-behave

← all detections