TLS supported groups

0017,0018,0019

first seen 2026-10-14 05:59 · last seen 2026-10-30 23:51 · JSON

Last 7 days (220 observations)

Distinct clients per day (last 30 days, peak 35/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order	`0017 (secp256r1), 0018 (secp384r1), 0019 (secp521r1)`
Group count	`3`
GREASE count	`0`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t12i130500_2d7513195f68_e51b7354d87f`	384
`t12d330600_5172cef6ed69_021165082e1c`	68
`t12d130600_2d7513195f68_e51b7354d87f`	27
`t12d130600_2d7513195f68_021165082e1c`	8
`t12d400600_44c89e5422f1_e51b7354d87f`	7
`t13d260900_6d1bcf7a4624_188c7f576dcd`	7
`t13d2610h2_6d1bcf7a4624_188c7f576dcd`	1

HTTP request (JA4H)

fingerprint	co-occurrences
`ge11nr040000_e1d2031bdfea_000000000000_000000000000`	494
`ge11nr13enus_695efbec79f4_000000000000_000000000000`	3
`ge11nn14enus_d9d4fb46dcb1_000000000000_000000000000`	1
`ge11nn09enus_05dc821be2d7_000000000000_000000000000`	1
`ge11nr14enus_d644675fec09_000000000000_000000000000`	1
`ge11nr14enus_d9d4fb46dcb1_000000000000_000000000000`	1
`ge20nr13enus_1d953776a77e_000000000000_000000000000`	1

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`4:32768;3:100;2:0\|4128769\|1:1:0:256\|a,m,p,s`	1

TCP SYN (p0f)

fingerprint	co-occurrences
`6:52+12:0:1440:mss*45,0:mss,sok,ts:flow:0`	121
`6:48+16:0:1440:mss*45,0:mss,sok,ts:flow:0`	85
`6:47+17:0:1440:mss*45,0:mss,sok,ts:flow:0`	85
`6:51+13:0:1440:mss*45,0:mss,sok,ts:flow:0`	62
`4:55+9:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	27
`4:57+7:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	25
`6:53+11:0:1440:mss*45,0:mss,sok,ts:flow:0`	20
`4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	9
`6:53+11:0:1440:mss*30,9:mss,nop,ws:flow:0`	9
`4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	7

TCP SYN (JA4T)

fingerprint	co-occurrences
`64800_2-4-8_1440_00`	379
`64240_2-4-8-1-3_1460_7`	83
`43200_2-1-3_1440_9`	9
`29200_2-4-8-1-3_1460_7`	8
`65535_2-1-3-4-8_1460_6`	8
`42340_2-1-3_1460_9`	6
`64240_2-4-8_1460_00`	5
`42340_2-1-1-4-1-3_1460_11`	2
`62020_2-4-8-1-3_8860_10`	2

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`	384
`Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36`	73
`Mozilla/5.0 (Linux; Android 11; M2004J15SC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.36`	8
`Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)`	7
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36`	7
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36`	3
`Mozilla/5.0 zgrab/0.x`	2
`Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36`	2
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0`	1
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36`	1

Country

fingerprint	co-occurrences
`US` · United States	459
`NL` · Netherlands	33
`DE` · Germany	7
`MN` · Mongolia	2
`IN` · India	1

Network (ASN)

fingerprint	co-occurrences
`AS63949` · Akamai Connected Cloud	384
`AS211680` · NSEC - Sistemas Informaticos, S.A.	51
`AS21859` · Zenlayer Inc	22
`AS6939` · Hurricane Electric LLC	12
`AS45102` · Alibaba (US) Technology Co., Ltd.	8
`AS14061` · DigitalOcean, LLC	7
`AS22616` · ZSCALER, INC.	7
`AS202425` · IP Volume inc	3
`AS22168` · The Shadowserver Foundation, Inc.	3
`AS45204` · GEMNET LLC	2