HTTP/3 uses passive QUIC-Initial detection on the shared UDP :443/:80 listeners (Alt-Svc advertised by server).
TURN uses passive Allocate/CreatePermission method detection on the same listeners.
IPv6 compares the server's TCP-side family with the client's IPv6-only fetch probe.
DNS runs a Cloudflare DoH whoami query (client-side) plus a UDP :53 listener (server-side, requires wildcard NS to detect real resolver leaks).
π AdsPower Mac profile check
π PC cluster identity
Cluster confidence
pc_cluster_id (cross-browser, 4 signals)
β¦
Originally: same id across different browsers on same PC β same physical machine.
Caveat (2026-05-20): on macOS+Chromium the 4 hashed signals are
browser-runtime constants, not hardware. Every Chrome on Apple Silicon produces
the same id. Trust the confidence tier above before treating matches as same-PC.
pc_browser_cluster_id (PC + browser, 18 signals)
β¦
Same id β same PC + same browser build. Different mdns_host_id β different profile on same PC.
Subject to the same class-signature caveat as pc_cluster_id β see confidence tier.
mdns_host_id (per browser profile, persistent)
β¦
π¨ Canvas anti-recovery probe
Tests how well CanvasRandomization protects you. Per-session noise alone is
not enough β a server that bucketizes visits and averages many
noised samples can reconstruct the unmodified base canvas. Three layers:
1. Within-session determinism (50 reads, this page-load)
runningβ¦
Zero variance = noise is per-session deterministic (anti-fp working).
Non-zero variance = noise re-rolled per call (broken / unusual config).
2. Recovery via localStorage (this browser profile, persistent across visits)
Latest noised
Recovered base
accumulatingβ¦
localStorage bucket per browser profile. Resets on new profile / private mode.
3. Recovery via server (this PC cluster, cross-profile)
Latest noised
Recovered base (server mean)
postingβ¦
Bucketed by pc_cluster_id (cross-browser PC identity) β i.e. mirrors what AdSense
can do when correlating by stable hardware signals across all your browser
profiles on this machine.
cluster stable signals used (audit)
vary signals (per-profile, audit)
Client-side fingerprint summary
Full fingerprint JSON (debug)
Scan layers:
β’ Network: TCP HTTP IP vs server-observed UDP IP on a per-session ephemeral STUN port (ground truth β no USERNAME-correlation needed) plus fixed STUN ports 3478/19302/443/80 (corp-firewall diagnostics), ICE host/srflx candidates, proxy headers (Via / X-Forwarded-For / CF-Connecting-IP)
β’ TLS: JA3/JA4 from raw ClientHello β TLS stack family identification
β’ Application: HTTP/2 Akamai-style fp from SETTINGS / WINDOW_UPDATE / HEADERS frame ordering
β’ Transport: TCP/IP p0f-style fp from initial SYN window/TTL/MSS/options (CGNAT-aware)
β’ Browser: canvas, WebGL, audio, font enumeration, Client Hints, WebGPU, codec matrix, sensors, ~50 properties
β’ Geo: country + ASN classification (datacenter/mobile/ISP) via MaxMind GeoLite2
β’ Coherence: cross-layer mismatch detection (TLSβUA, TCP-OSβUA-OS, TZβcountry, ClientHintsβnavigator)
β’ HTTP/3 / QUIC (passive): Alt-Svc-advertised h3=":443"; QUIC Initial packets that arrive on the shared UDP :443/:80 STUN listeners are bucketed per session
β’ TURN relay (passive): non-binding STUN methods (Allocate / CreatePermission / ChannelBind) detected on the same listeners; a TURN URI is also added to the client's iceServers to force an Allocate attempt
β’ IPv6 AAAA: server TCP-family detection + client IPv6-only fetch probe (compares browser capability with what the server saw on its side)
β’ DNS leak: client-side DoH whoami query (Cloudflare) + server-side UDP :53 listener (latter only catches real resolver leaks when wildcard NS for *.dns.<host> points here β see CHEATSHEET Β§16)