TLS supported groups

11ec,001d,0017,001e,0018,0019,0100,0101

first seen 2026-10-14 07:29 · last seen 2026-10-31 00:52 · JSON

Last 7 days (5225 observations)

Distinct clients per day (last 30 days, peak 13163/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order11ec (X25519MLKEM768), 001d (x25519), 0017 (secp256r1), 001e (x448), 0018 (secp384r1), 0019 (secp521r1), 0100 (ffdhe2048), 0101 (ffdhe3072)
Group count8
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d3013h2_1d37bd780c83_8537cf56674e13783
t13d1713h1_ab0a1bf427ad_ecd0401ec68b Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.5294
t13d171200_ab0a1bf427ad_ecd0401ec68b203
t13d5212h1_b262b3658495_8e6e362c5eac Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 24.21.0, node-fetch 24.19.0, node-fetch 22.23.1, +8 more.The fingerprint page shows the full measured match list. More on the catalog.80
t13d1114h2_c5d436628c5c_d2ecb680261748
t13d3013h1_1d37bd780c83_8537cf56674e47
t13d521100_b262b3658495_8e6e362c5eac39
t13d3012h2_1d37bd780c83_8e6e362c5eac30
t13d3013h1_1d37bd780c83_ecd0401ec68b28
t13d1712h1_ab0a1bf427ad_8e6e362c5eac21

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn030000_bf75ddd0bb29_000000000000_00000000000013660
ge11nn080000_4e3e811ee70f_000000000000_0000000000004708
ge11nn050000_be0d0b335e46_000000000000_000000000000487
ge11nn05enus_f3bb7aa45ec4_000000000000_000000000000298
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more.The fingerprint page shows the full measured match list. More on the catalog.120
ge11nn050000_b223a0ebb0b5_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.43
ge20nn04enus_39a3ba4480e8_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: urlsession 6.1.2.The fingerprint page shows the full measured match list. More on the catalog.32
ge11nn07*000_2f91038604b7_000000000000_00000000000027
ge20nn030000_ff50983941c1_000000000000_00000000000024
ge11nn07enus_71b742b5154a_000000000000_00000000000022

HTTP/2 frames (Akamai)

fingerprintco-occurrences
3:100;4:65536;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.13785
2:0;4:65535|67043329|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: powershell 7.6.6, powershell 7.6.8.The fingerprint page shows the full measured match list. More on the catalog.48
2:0;4:2097152;5:16384;6:16384|5177345|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: rust-reqwest 0.12.28, rust-reqwest 0.13.5, rust-reqwest 0.13.4, +4 more.The fingerprint page shows the full measured match list. More on the catalog.30
2:0;4:262144|458753|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: node-fetch 26.4.0.The fingerprint page shows the full measured match list. More on the catalog.6
1:4096;2:0;4:65535;5:16384;3:100;6:65536|16777216|0|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.5
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:220|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 152.0.7977.83, +81 more.The fingerprint page shows the full measured match list. More on the catalog.2
2:0|00|0|m,p,a,s2
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;2:0;4:6291456;6:262144|15663105|3:1:0:220|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 147.0.7727.15, chromium 145.0.7632.6, +26 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;2:0;4:6291456;6:262144|15663105|5:1:0:220|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chromium 133.0.6943.16, chrome 156.0.8078.48, chrome 150.0.7871.128, +3 more.The fingerprint page shows the full measured match list. More on the catalog.1

TCP SYN (p0f)

fingerprintco-occurrences
4:119+9:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:03362
4:116+12:0:1460:62727,7:mss,sok,ts,nop,ws:df,id+:01366
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0856
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0830
4:48+16:0:1460:mss*29,13:mss,sok,ts,nop,ws:df,id+:0670
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:0643
4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0625
4:56+8:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0607
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0537
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0524

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_76366
62727_2-4-8-1-3_1460_75190
64800_2-4-8-1-3_1440_7896
42340_2-4-8-1-3_1460_12751
42340_2-4-8-1-3_1460_13674
64240_2-4-8-1-3_1460_8626
29184_2-4-8-1-3_1363_7506
65535_2-4-8-1-3_1380_13424
62720_2-4-8-1-3_1460_8318
42340_2-4-8-1-3_1460_9313

QUIC transport params

fingerprintco-occurrences
q11_415b770c4d961

User-Agent

fingerprintco-occurrences
curl/8.14.113678
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; YouBot/1.0; +https://docs.you.com/youbot; env:prod) Chrome/142.0.0.0 Safari/537.365178
Mozilla/5.0 (compatible; ElevenlabsCrawler/1.0; +https://elevenlabs.io/docs/bots)298
Mozilla/5.080
Mozilla/5.0 (compatible; The Lounge IRC Client; +https://github.com/thelounge/thelounge) facebookexternalhit/1.1 Twitterbot/1.033
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.3632
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; KeenableBot/1.0; +https://keenable.ai/bot)30
Mozilla/5.0 (compatible; QlyzeBot/1.0; +https://app.qlyze.io/bot)28
node21
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3617

Country

fingerprintco-occurrences
US · United States8205
DE · Germany2722
NL · Netherlands1447
FR · France945
GB · United Kingdom850
JP · Japan740
CA · Canada542
PL · Poland496
SG · Singapore430
KR · South Korea359

Network (ASN)

fingerprintco-occurrences
AS14618 · Amazon.com, Inc.5199
AS14061 · DigitalOcean, LLC2490
AS211619 · MAXKO d.o.o.1395
AS12876 · Scaleway SAS1317
AS63949 · Akamai Connected Cloud1028
AS21859 · Zenlayer Inc644
AS16276 · OVH SAS539
AS13335 · Cloudflare, Inc.476
AS31898 · Oracle Corporation369
AS9009 · M247 Europe SRL308