TLS supported groups

001d,0017,0018,0019,001e,0100,0101,0102,0103,0104

first seen 2026-10-14 06:04 · last seen 2026-10-30 23:51 · JSON

Last 7 days (492 observations)

Distinct clients per day (last 30 days, peak 192/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order001d (x25519), 0017 (secp256r1), 0018 (secp384r1), 0019 (secp521r1), 001e (x448), 0100 (ffdhe2048), 0101 (ffdhe3072), 0102 (ffdhe4096), 0103 (ffdhe6144), 0104 (ffdhe8192)
Group count10
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1513h1_8daaf6152771_246833c5720e386
t13d491200_bd868743f55c_7c76daad20ec Match?Exact match in Thumbprint's published controlled catalog captures: java-urlconnection 17.0.12.The fingerprint page shows the full measured match list. More on the catalog.193
t13d3112h1_1d947a95fc68_b72e173852fa Match?Exact match in Thumbprint's published controlled catalog captures: java-urlconnection 11.0.31.The fingerprint page shows the full measured match list. More on the catalog.89
t13d3113h1_1d947a95fc68_7e1102d2036b38
t13d311200_1d947a95fc68_7e1102d2036b Match?Exact match in Thumbprint's published controlled catalog captures: java-urlconnection 17.0.19.The fingerprint page shows the full measured match list. More on the catalog.23
t12d280900_0df5e5c63df4_5c2ba267272411
t13d1114h2_5e2a75874763_89e9e4bb34196
t13d3113h2_1d947a95fc68_7e1102d2036b Match?Exact match in Thumbprint's published controlled catalog captures: java-httpclient 17.0.19, java-httpclient 25.0.4.1, java-httpclient 25.0.3, +3 more.The fingerprint page shows the full measured match list. More on the catalog.5
t13d1514h2_8daaf6152771_a5b99884f7f52
t12d340900_0ca14b6c4d46_686390af6b8e2

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn07enus_b37364d1b8ae_000000000000_000000000000386
ge11nn070000_cfd688ca49e2_000000000000_000000000000186
ge11nn07cscz_62ad33df7c0a_000000000000_00000000000091
ge11nn07cscz_d4021d63333c_000000000000_00000000000021
ge11nn040000_487c3246ac94_000000000000_00000000000017
ge10nr040000_532a1ee47909_000000000000_00000000000013
ge11nn06cscz_f604b96915d0_000000000000_00000000000013
ge11nn060000_9078d5dd083b_000000000000_0000000000007
ge20nn030000_6dac75bd47eb_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.3
ge20nn020000_b89ce445e0b3_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.27.1, go-net/http 1.27.0, +14 more.The fingerprint page shows the full measured match list. More on the catalog.3

HTTP/2 frames (Akamai)

fingerprintco-occurrences
4:16777216|16711681|0|m,p,a,s8
1:16384;2:0;3:0;4:16777216;5:16384;6:393216|33488897|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: java-httpclient 17.0.19, java-httpclient 11.0.31, java-httpclient 25.0.4.1, +7 more.The fingerprint page shows the full measured match list. More on the catalog.5

TCP SYN (p0f)

fingerprintco-occurrences
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0265
4:53+11:0:1460:mss*44,8:mss,sok,ts,nop,ws:df,id+:0193
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0123
6:43+21:0:1440:mss*45,10:mss,sok,ts,nop,ws:flow:085
6:45+19:0:1440:mss*45,10:mss,sok,ts,nop,ws:flow:030
4:52+12:0:1410:mss*30,12:mss,sok,ts,nop,ws:df,id+:016
4:57+7:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:011
6:41+23:0:1440:mss*45,10:mss,sok,ts,nop,ws:flow:09
4:42+22:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:06
4:120+8:0:1460:62727,10:mss,sok,ts,nop,ws:df,id+:04

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_7392
64240_2-4-8-1-3_1460_8193
64800_2-4-8-1-3_1440_10127
42300_2-4-8-1-3_1410_1216
42340_2-4-8-1-3_1460_1212
64240_2-4-8-1-3_1460_106
62727_2-4-8-1-3_1460_106
65535_2-4-8-1-3_1460_92
65535_2-4-8-1-3_1460_22
29200_2-4-8-1-3_1460_71

User-Agent

fingerprintco-occurrences
TokenFoundryBot/1.0 (TFBot@service.alibaba.com)386
Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)193
Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)127
Mozilla/5.0 (compatible; KakaoBot/1.0; +https://cs.kakao.com/helps_html/1073213012)17
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3613
okhttp/5.3.03
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.13
AstraciaBot/1.0 (+https://astracia.com)3
AstraciaBot/1.0 (+https://astracia.com; affiliate program check)2
ResearchGateBot/1.0 (+https://www.researchgate.net/)2

Country

fingerprintco-occurrences
HK · Hong Kong SAR China386
FR · France193
CZ · Czechia127
KR · South Korea18
NL · Netherlands12
US · United States9
DE · Germany7
LT · Lithuania2
IS · Iceland2
CA · Canada1

Network (ASN)

fingerprintco-occurrences
AS45102 · Alibaba (US) Technology Co., Ltd.386
AS210743 · BABBAR SAS193
AS43037 · Seznam.cz, a.s.127
AS210328 · AO ALMAZ7
AS24940 · Hetzner Online GmbH6
AS14618 · Amazon.com, Inc.6
AS7625 · Kakao Corp6
AS18160 · Kakao Corp6
AS152199 · Kakao Corp6
AS211486 · Alferov Aleksey Aleksandrovich4