TLS supported groups

0017,0019,001c,001b,0018,001a,0016,000e,000d,000b,000c,0009,000a

first seen 2026-10-15 11:37 · last seen 2026-10-27 01:03 · JSON

Last 7 days (9 observations)

Distinct clients per day (last 30 days, peak 2/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order0017 (secp256r1), 0019 (secp521r1), 001c (brainpoolP512r1), 001b (brainpoolP384r1), 0018 (secp384r1), 001a (brainpoolP256r1), 0016 (secp256k1), 000e (sect571r1), 000d (sect571k1), 000b (sect409k1), 000c (sect409r1), 0009 (sect283k1), 000a (sect283r1)
Group count13
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t12i570500_2a2bed94251f_a1e9356827959
t12d860600_e18388e7f3a3_a1e9356827954
t12d4907h1_730fb1b0ac6a_8587f467d9ea2
t12d650700_0dd215169a35_4446390ac2241

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn020000_70500bd9c457_000000000000_0000000000005
ge11nn040000_3d99853a3f52_000000000000_0000000000004
ge11nn06enus_ff6fe191b79d_000000000000_0000000000004
ge11nr08enus_12041bebc190_000000000000_0000000000001
ge11nn08enus_f7c64dd4d2b3_000000000000_0000000000001
ge11nn06enus_c0344d278358_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:53+11:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:06
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:50+14:0:1460:mss*44,11:mss,sok,ts,nop,ws:df,id+:01
4:118+10:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01
4:116+12:0:1460:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:01
4:106+22:0:1440:65535,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01
4:44+20:0:1330:mss*49,10:mss,sok,ts,nop,ws:df,id+:01
4:119+9:0:1360:mss*48,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01
4:114+14:0:1280:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01
4:113+15:0:1280:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_117
64240_2-4-8-1-3_1460_72
64240_2-1-3-1-1-4_1460_82
64240_2-1-3-1-1-4_1280_82
65535_2-1-3-1-1-4_1440_81
65280_2-1-3-1-1-4_1360_81
65170_2-4-8-1-3_1330_101

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.364
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.362
Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.361
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.361
Mozilla/6.4 (Windows NT 11.1) Gecko/2010102 Firefox/99.01

Country

fingerprintco-occurrences
US · United States11
IN · India2
FR · France1
PL · Poland1
SI · Slovenia1

Network (ASN)

fingerprintco-occurrences
AS174 · Cogent Communications, LLC7
AS10439 · CariNet, Inc.2
AS22295 · Advin Services LLC2
AS8075 · Microsoft Corporation1
AS14061 · DigitalOcean, LLC1
AS9009 · M247 Europe SRL1
AS201814 · MEVSPACE sp. z o.o.1
AS197769 · VPS Dedicated LLC1