OS fingerprint spoofing

Why it matters#

A proxy hides your IP, but the target still reads the TCP handshake that the proxy server sends: the starting TTL, the window size, the maximum segment size and the order of TCP options. Tools such as p0f turn those values into a guess of the operating system. A browser that says it is Windows Chrome while its packets look like a Linux server is a mismatch that anti-fraud systems notice, and a thousand connections that all look like the same server form a pattern.

Spoofing rewrites the handshake on the proxy side, so the target sees the TCP signature of the system you choose.

Profiles#

The three Windows profiles send identical packets, because TCP does not carry the browser's name. Pick the one that matches the browser you run, so the labels in your own setup stay tidy. The measured packets for every profile are on the OS fingerprint spoofing page.

Turning it on#

1. 1

   Open the ISP or datacenter order

   My orders, then the order.

2. 2

   Connection settings, OS fingerprint spoofing

   Pick a profile and apply. It covers every proxy in the order, and it is free.

3. 3

   Start new connections

   Close keep-alive pools or restart the browser profile. The new signature applies to new connections only.

To turn it off, pick No spoofing (off) in the same list. Switching off takes up to a minute and a half to reach every proxy host.

Keep the story consistent#

• Match the User-Agent and client hints of your browser or code to the profile. Windows packets with a macOS User-Agent are a new mismatch, not a fix.
• Spoofing works only for traffic authenticated with a password. While the IP whitelist has any address, it is paused.
• It changes the TCP layer. TLS and browser fingerprints come from your client, so use a browser or library that matches the chosen system.

Other products#