TLS supported groups

001d,0017,001e,0019,0018

first seen 2026-10-14 05:48 · last seen 2026-10-31 01:11 · JSON

Last 7 days (8997 observations)

Distinct clients per day (last 30 days, peak 443/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order	`001d (x25519), 0017 (secp256r1), 001e (x448), 0019 (secp521r1), 0018 (secp384r1)`
Group count	`5`
GREASE count	`0`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d311000_8ae6a2f5ac15_5ac7197df9d2`	19506
`t13d3111h2_e8f1e7e78f70_5ac7197df9d2`	5578
`t13d4312h1_c7886603b240_b26ce05bbdd6`	88
`t13d3113h2_e8f1e7e78f70_1b3407e2c936`	59
`t13d1812h1_85036bcba153_b26ce05bbdd6`	23
`t13d3112h1_e8f1e7e78f70_8d633dac7124` Match?Exact match in Thumbprint's published controlled catalog captures: curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	21
`t13d3612h1_018971650b2c_58ed7828516f`	14
`t13d3612h1_018971650b2c_e8b3fe21f08b`	9
`t13d1812h1_85036bcba153_d41ae481755e`	8
`t13d3112h2_e8f1e7e78f70_8d633dac7124` Match?Exact match in Thumbprint's published controlled catalog captures: curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	8

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nn050000_be0d0b335e46_000000000000_000000000000`	19506
`ge20nn030000_6dac75bd47eb_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.	5129
`ge20nn030000_80b089f68b8e_000000000000_000000000000`	389
`ge11nn050000_b223a0ebb0b5_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.	102
`ge20nr020000_5594a17e7e7e_000000000000_000000000000`	55
`ge20nn040000_3dccbaa13f05_000000000000_000000000000`	47
`ge11nn040000_e1d2031bdfea_000000000000_000000000000`	22
`ge11nn05enus_262fa54a7046_000000000000_000000000000`	14
`ge11nn050000_3658ef221638_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.25.0, wget 1.21.3.The fingerprint page shows the full measured match list. More on the catalog.	9
`ge20nn020000_5594a17e7e7e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more.The fingerprint page shows the full measured match list. More on the catalog.	8

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:4096;2:0;5:16384;6:131072;3:100;4:65536\|26148865\|0\|m,s,p,a`	5578
`3:100;4:33554432;2:0\|33488897\|0\|m,p,s,a` Match?Exact match in Thumbprint's published controlled catalog captures: php-curl 7.88.1, curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	60
`3:100;4:65536;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	8
`3:100;4:1073741824;2:0\|1073676289\|0\|m,p,s,a`	4
`1:4096;2:0;4:65535;5:16384;3:100;6:65536\|16777216\|0\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.	1

TCP SYN (p0f)

fingerprint	co-occurrences
`4:54+10:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:0`	4987
`4:53+11:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:0`	4957
`4:48+16:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:0`	4638
`4:50+14:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:0`	4459
`6:56+8:0:1380:65535,8:mss,sok,ts,nop,ws::0`	3632
`6:58+6:0:1380:65535,8:mss,sok,ts,nop,ws::0`	411
`6:46+18:0:1380:65535,8:mss,sok,ts,nop,ws::0`	393
`6:48+16:0:1380:65535,8:mss,sok,ts,nop,ws::0`	389
`6:53+11:0:1380:65535,8:mss,sok,ts,nop,ws::0`	315
`6:55+9:0:1380:65535,8:mss,sok,ts,nop,ws::0`	259

TCP SYN (JA4T)

fingerprint	co-occurrences
`64240_2-4-8-1-3_1460_11`	19046
`65535_2-4-8-1-3_1380_8`	5580
`62720_2-4-8-1-3_8960_11`	461
`64240_2-4-8-1-3_1400_7`	46
`29200_2-4-8-1-3_1400_7`	45
`64240_2-4-8-1-3_1460_7`	32
`32768_2-1-3-4-8_1460_10`	32
`64800_2-4-8-1-3_1440_7`	15
`26883_2-4-8-1-3_1460_11`	14
`64240_2-1-3-1-1-4_1460_8`	11

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)`	19506
`facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)`	5292
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler))`	121
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler))`	93
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0`	82
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler))`	36
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`	22
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler))`	22
`Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)`	11
`Mozilla/5.0 (Linux; Android 6.0.1; F-01J Build/V17R048B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36`	11

Country

fingerprint	co-occurrences
`US` · United States	23928
`DE` · Germany	417
`SG` · Singapore	406
`GB` · United Kingdom	405
`CN` · China	105
`NL` · Netherlands	39
`RU` · Russia	12
`HK` · Hong Kong SAR China	9
`SE` · Sweden	4
`FR` · France	4

Network (ASN)

fingerprint	co-occurrences
`AS209366` · SEMrush CY LTD	19506
`AS32934` · Facebook, Inc.	5579
`AS4837` · CHINA UNICOM China169 Backbone	54
`AS4134` · CHINANET BACKBONE	37
`AS215125` · Church of Cyberology	32
`AS14618` · Amazon.com, Inc.	16
`AS63949` · Akamai Connected Cloud	15
`AS13238` · YANDEX LLC	11
`AS45102` · Alibaba (US) Technology Co., Ltd.	9
`AS17638` · ASN for TIANJIN Provincial Net of CT	6

fingerprint	co-occurrences
`1:4096;2:0;5:16384;6:131072;3:100;4:65536\|26148865\|0\|m,s,p,a`	5578
`3:100;4:33554432;2:0\|33488897\|0\|m,p,s,a` Match?Exact match in Thumbprint's published controlled catalog captures: php-curl 7.88.1, curl 7.88.1.The fingerprint page shows the full measured match list. More on the catalog.	60
`3:100;4:65536;2:0\|1048510465\|0\|m,s,a,p` Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.	8
`3:100;4:1073741824;2:0\|1073676289\|0\|m,p,s,a`	4
`1:4096;2:0;4:65535;5:16384;3:100;6:65536\|16777216\|0\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.	1