Dangermouse grades whether a visit looks like a real person on a real device. Every page here is a report card about the visit that requested it, so what it collects is the visit itself. It is a measurement site: nothing is sold, shared for advertising, or joined to an identity.

What is collected

• The connection: the TLS ClientHello (cipher suites, extensions, the JA4 fingerprint), the HTTP/2 or HTTP/1.1 framing and header order, the TCP round-trip time and segment size where the platform reports them, and your IP address.
• The request: method, host, path, every query parameter (echoed back on the card), and the request headers in the order they arrived, including client hints.
• Lookups on the address: country, city-level location and time zone, the network (AS number and organisation), whether the address is listed as a proxy, VPN, hosting range, Tor exit or documented crawler, and its reverse DNS name.
• The page script's measurements (the beacon): screen and window geometry, time zone, language, which browser features and fonts are present, the graphics renderer and a canvas hash, installed speech voices, DRM support, CPU and memory hints, the WebRTC candidate addresses, page-load timing for this site's own files, and a coarse count of pointer, key and scroll events (counts and timing only). The beacon carries no form input, nothing you type, and no content from other sites.
• Follow-up requests: which of this page's own files (stylesheet, icon, script) were fetched, and whether a link hidden from people and disallowed in robots.txt was followed.

Why

Each item feeds a check on the card: does the TLS library match the browser the User-Agent claims, do the headers arrive in that browser's order, does the device the script measures match the one the headers describe, has this address or device been seen many times. Counts across visits (population facets) are kept so that a burst of visits from one device or address can be recognised.

The one cookie

The site sets exactly one cookie, dm: a random value, first-party (host-only, no Domain attribute), HttpOnly, Secure, SameSite=Lax, kept for 365 days. It is set only on the report page, never on files, the beacon or other paths. It is a population key: it lets the population facets tell a returning browser from a new one. The server stores only a keyed hash of the value, never the value itself. Clearing it makes your next visit look like a first visit and changes nothing else.

How long it is kept

• Visits (the capture, the beacon and the grade) are kept for 90 days, so a report can be re-fetched by its visit ID and re-graded when the knowledge base improves. After that the report returns 404. The exception is the handful of visits the operator tags into the regression corpus of known real devices: those are kept until they are untagged, with their addresses hashed like any other.
• IP addresses are kept in clear for the population window of 30 days and then replaced by a keyed hash; the population counters keep working on the hash.
• Population counters decay over hours to days and hold hashes and counts, not addresses.
• The dm cookie expires in your browser after 365 days.

Privacy browsers

Some browsers lie about the device on purpose to resist fingerprinting. When the page script detects Brave or Firefox's resist-fingerprinting mode, the card applies an allowance so that privacy protection is not graded as fraud:

• the fonts-versus-operating-system check is downgraded one step: red becomes yellow, and yellow becomes gray;
• a WebRTC address mismatch becomes gray (not scored) instead of a failure;
• the screen-geometry and time-zone checks are gray (not scored);
• the Sec-GPC (Global Privacy Control) header alone does not switch the allowance on: it is recorded, but it is not evidence of a privacy browser.

Knowledge base

The checks compare each visit with a knowledge base built from public sources. Knowledge base 2026.11.3, built 2026-11-01.

• android-build-numbers: CC BY 4.0 (source.android.com content licence)
• aosp-fonts: Apache-2.0 (AOSP)
• apify-fingerprint-suite: Apache-2.0
• apple-bot: Apple public
• apple-system-fonts: Apple site content; font metadata facts only, no font files
• appledb-devices: MIT (littlebyteorg/appledb LICENSE e02a4b6; README: data under MIT)
• appledb-ios: MIT (littlebyteorg/appledb LICENSE e02a4b6; README: data under MIT)
• asdb: Stanford ASdb terms (login required)
• aws: AWS public ranges; no explicit licence
• azure: Microsoft Service Tags; Microsoft download terms
• bing-bot: Microsoft public
• burrowgate: MIT
• chrome-prefetch-proxy: Google public geofeed
• chrome-versionhistory: Google APIs ToS; data is public
• chromium-ua-utils: BSD-3-Clause (Chromium authors)
• cldr-supplemental: Unicode License v3 (CLDR)
• cloudflare: Cloudflare public list
• crawler-user-agents: MIT
• devtools-emulated-devices: BSD-3-Clause (Chromium authors)
• digitalocean: DigitalOcean public geofeed
• discord: Discord public
• edge-updates: Microsoft public update feed; no explicit licence
• endoflife-date: MIT (endoflife.date)
• fastly: Fastly public API
• foxio-ja4-mapping: JA4 BSD-3-Clause; JA4+ (S/H/X/T/TScan) FoxIO License 1.1, patent pending
• gcp: Google Cloud public ranges (Apache-2.0 for docs; data public)
• google-crawlers: Google APIs ToS; data is public
• gpuinfo-opengles: CC BY 4.0, attribution to Sascha Willems / opengles.gpuinfo.org
• ias-bot: IAS public policy doc
• impersonation-profiles: utls BSD-3-Clause; tls-client BSD-4-Clause; curl-impersonate MIT
• intoli-user-agents: MIT
• ipswme: ipsw.me public API: no licence stated; API spec asks for fair use; contact support+api@ipsw.me
• iptoasn: PDDL 1.0 (iptoasn.com)
• ipverse-bots: CC0
• linode: Akamai/Linode public geofeed (RFC 8805)
• lord-alfred-ipranges: CC0
• matomo-device-detector: LGPL-3.0
• mdn-bcd: CC0-1.0
• meta-radb: RADB IRR public data
• mozilla-product-details: MPL-2.0 (mozilla product-details)
• ms-fonts: Microsoft Learn content (CC BY 4.0 docs); font metadata facts only
• openai-bots: OpenAI public
• oracle: Oracle public ranges; no explicit licence
• peeringdb: PeeringDB AUP / CC0 data; unauthenticated API throttled
• pixel-factory-images: Google developer site; terms apply
• pixel-support: Google Help content
• play-device-catalog-mirror: Apache-2.0 repo; underlying data is a Google Play Console export, redistribution unclear (internal use only)
• play-supported-devices: Google Play public data
• playwright-devices: Apache-2.0
• private-relay: Apple public egress list
• readium-speech: BSD-3-Clause
• samsung-csc-codes: MIT (repository licence)
• samsung-doc: Official Samsung site; no API terms; scraped politely
• samsung-fota: Undocumented device-update endpoint; unofficial
• samsung-workscope: Samsung public web page
• tor-exits: Tor Project public list
• tzdb: Public domain (IANA tz database)
• x4bnet-vpn: see github.com/X4BNet/lists_vpn (not verified)
• hand: Project-owned (hand tables and known-bad captures of this repository)

GPU renderer data from opengles.gpuinfo.org by Sascha Willems, CC BY 4.0

AppleDB, © 2022 emiyl, MIT License, https://github.com/littlebyteorg/appledb

AppleDB credits portions of its data to The Apple Wiki (theapplewiki.com, CC BY-SA) and hack-different/apple-knowledge (MIT)

Software 647e249. Back to a report card for this visit.