Browser integrity report

0.000s/ 120.000s client budget

starting

0 / 0 collectors resolved

Network layertaken from the TLS handshake and the SYN packet, before any script ran

JA4—

JA4H—

HTTP/2—

TCP/IP—

Verdict

Analyzing

No evidence has reached the correlator yet. The page submits a safe baseline first, then enriches it one collector at a time.

—/ 100 riskpending

0–19 consistent20–59 suspicious60–100 spoofed

What this client isMeasured values are shown as captured. Anything a probe did not answer says so rather than being filled in.Full evidence

Operating systemcollecting

waiting for the first evidence

Browsercollecting

waiting for the first evidence

Graphicscollecting

waiting for the first evidence

Processorcollecting

waiting for the first evidence

Memorycollecting

waiting for the first evidence

Displaycollecting

waiting for the first evidence

Region & timecollecting

waiting for the first evidence

Networkcollecting

waiting for the first evidence

contradictions

—

sources committed

—

collectors returned

—

identity

—

Advanced viewEvery source, its claim, its spoofability and the raw bytes behind it.show / hide

Evidence by category

Every source that can speak, grouped by how hard it is to make it lie. A source with nothing to say is shown saying nothing — never filled in.

agreesconflictsabstainsnot observed

Network layer

Captured at TLS termination, below anything JavaScript can reach. This is the edge: a browser cannot rewrite its own handshake from userland.

7 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
JA4 · TLS ClientHelloclaims browserfp-front	collecting	collecting…	—	hard	nothing captured
JA4H · HTTP request shapeclaims browserfp-front	collecting	collecting…	—	hard	nothing captured
HTTP/2 · Akamai fingerprintclaims whether this is a browser at allfp-front	collecting	collecting…	—	hard	nothing captured
Header order & casingclaims browserfp-front	collecting	collecting…	—	hard	nothing captured
Passive TCP/IP · SYN packetclaims operating systemfp-front	collecting	collecting…	—	hard	nothing captured
Page origin · Refererclaims did a human load a pagefp-front	collecting	collecting…	—	easy	nothing captured
Accept-Language request headerclaims which locale the network stack asked fornetwork	collecting	collecting…	—	medium	nothing captured

Userland declarations

What the page says about itself. Never evidence alone — only their agreement with each other and with the network layer means anything.

2 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
User-Agent stringclaims browser + operating systembrowser	collecting	collecting…	—	trivial	nothing captured
UA Client Hintsclaims operating system + architecturebrowser	collecting	collecting…	—	easy	nothing captured

Graphics stack

The GPU string names the driver, which names the operating system. One of the hardest client signals to spoof coherently.

2 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
WebGL unmasked rendererclaims operating system (via GPU) + browserbrowser	collecting	collecting…	—	medium	nothing captured
WebGPU adapterclaims operating system (via GPU)browser	collecting	collecting…	—	medium	nothing captured

JS engine behaviour

How the engine computes, not what it claims. A TLS-impersonation library has no JavaScript engine at all, so a replayed blob cannot produce these.

7 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
Web Audio DSPclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured
Math · IEEE-754 differentialclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured
PermissionName enumclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured
ImageData & TextMetrics membersclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured
navigator.plugins object graphclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured
media features the CSS parser enablesclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured
PerformanceObserver entry typesclaims browser enginebrowser	collecting	collecting…	—	hard	nothing captured

Operating-system surface

What the host installed underneath the browser. Confidence is deliberately conservative until a multi-host corpus separates "this OS" from "this machine".

2 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
Installed fontsclaims operating systembrowser	collecting	collecting…	—	medium	nothing captured
Speech synthesis voicesclaims operating systembrowser	collecting	collecting…	—	medium	nothing captured

Real network & geography

Where the client actually is, versus where it says it is. STUN is UDP and goes direct, so a proxy does not hide it.

3 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
WebRTC · offer shape + srflxclaims browser engine + real networkbrowser + ipintel	collecting	collecting…	—	hard	nothing captured
Timezoneclaims region, checked against the IPbrowser	collecting	collecting…	—	easy	nothing captured
Socket peer geographyclaims country of the connecting addressfp-front	collecting	collecting…	—	hard	nothing captured

Controls

Not claims. Fixed expected values whose failure is the whole signal — these are the tripwires on the automation axis.

3 running

Signal	State	Claim	Confidence	Spoofability	Raw evidence
Canvas integrity controlsclaims is the pixel surface being rewrittenbrowser	collecting	collecting…	—	control	nothing captured
PDF viewer plugin tripleclaims do plugins, mimeTypes and pdfViewerEnabled agree as HTML pins thembrowser	collecting	collecting…	—	control	nothing captured
Evidence surface coverageclaims is the evidence surface being suppressedbrowser	collecting	collecting…	—	control	nothing captured

sample —schema —one-time nonce —

Heuristic consistency result. Weights and thresholds are calibrated against one host plus its guest — treat the score as a ranking, not a probability, until the multi-host corpus lands.