TLS supported groups

11ec,11ed,11eb,0202,001d,0017,0018,0019

first seen 2026-10-15 04:20 · last seen 2026-10-30 16:40 · JSON

Last 7 days (3 observations)

Distinct clients per day (last 30 days, peak 3/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order11ec (X25519MLKEM768), 11ed (SecP384r1MLKEM1024), 11eb (SecP256r1MLKEM768), 0202 (MLKEM1024), 001d (x25519), 0017 (secp256r1), 0018 (secp384r1), 0019 (secp521r1)
Group count8
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d190900_9dc949149365_97f8aa674fd96

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn040000_e1d2031bdfea_000000000000_0000000000006

TCP SYN (p0f)

fingerprintco-occurrences
6:51+13:0:1440:mss*15,10:mss,sok,ts,nop,ws:flow:02
6:53+11:0:1440:mss*15,10:mss,sok,ts,nop,ws:flow:02
4:52+12:0:1460:mss*15,10:mss,sok,ts,nop,ws:df,id+:01
4:55+9:0:1460:mss*15,10:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
21600_2-4-8-1-3_1440_104
21900_2-4-8-1-3_1460_102

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)6

Country

fingerprintco-occurrences
US · United States6

Network (ASN)

fingerprintco-occurrences
AS398324 · Censys, Inc.6