TLS supported groups
001d,0017,001e,0019,0018,0100,0101,0102,0103,0104
first seen 2026-10-14 05:50 · last seen 2026-10-31 00:52 · JSON
Matches controlled captures
Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog → A group list is a TLS-stack trait, so unrelated clients on one library share it, and it says nothing about the group the server chose.
php-curl 7.88.1 · Debian 12 · container — 1 session, last 2026-10-27 23:05 controlled php-guzzle 8.3.1 · Ubuntu 22.04 · container — 1 session, last 2026-10-27 23:05 controlled wget 1.25.0 · Alpine Linux 3.21.9 · container — 1 session, last 2026-10-27 23:04 controlled curl 7.88.1 · Debian 12 · via seclevel0-http1 · container — 1 session, last 2026-10-27 23:04 controlled curl 7.88.1 · Debian 12 · via seclevel0 · container — 1 session, last 2026-10-27 23:04 controlled curl 8.13.0 · Alpine Linux 3.21.3 · container — 2 sessions, last 2026-10-26 23:24 controlled php-guzzle 8.3.1 · Debian 12 · container — 1 session, last 2026-10-26 20:31 controlled php-guzzle 7.16.1 · Debian 12 · container — 1 session, last 2026-10-26 20:30 controlled rust-hyper 1.12.0 · Debian 12 · via native-tls · container — 1 session, last 2026-10-20 23:03 controlled rust-reqwest 0.13.5 · Debian 12 · via native-tls · container — 1 session, last 2026-10-20 23:03 controlled
Last 7 days (8433 observations)
Distinct clients per day (last 30 days, peak 2743/day)
Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.
Decomposed attributes
Groups in wire order 001d (x25519), 0017 (secp256r1), 001e (x448), 0019 (secp521r1), 0018 (secp384r1), 0100 (ffdhe2048), 0101 (ffdhe3072), 0102 (ffdhe4096), 0103 (ffdhe6144), 0104 (ffdhe8192)Group count 10GREASE count 0
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
HTTP request (JA4H)
fingerprint co-occurrences
ge11nn050000_b223a0ebb0b5_000000000000_000000000000Match? Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3 . The fingerprint page shows the full measured match list. More on the catalog. 18872 ge11nn020000_818f42cc3fd7_000000000000_000000000000Match? Exact match in Thumbprint's published controlled catalog captures: php-guzzle 8.2.0, php-guzzle 8.1.0, php-guzzle 8.0.2, +13 more . The fingerprint page shows the full measured match list. More on the catalog. 2735 ge20nn030000_6dac75bd47eb_000000000000_000000000000Match? Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1 . The fingerprint page shows the full measured match list. More on the catalog. 2458 ge11nr040000_177aea7101ae_000000000000_0000000000001884 ge10nn020000_d5c75abc5c2c_000000000000_000000000000136 ge20nn060000_2a1d139103bd_000000000000_000000000000116 ge20nn020000_5594a17e7e7e_000000000000_000000000000Match? Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more . The fingerprint page shows the full measured match list. More on the catalog. 54 ge11nn050000_ea6f06182064_000000000000_00000000000029 ge11nn030000_7dedce931117_000000000000_00000000000021 ge11nn050000_3658ef221638_000000000000_000000000000Match? Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.25.0, wget 1.21.3 . The fingerprint page shows the full measured match list. More on the catalog. 13
HTTP/2 frames (Akamai)
fingerprint co-occurrences
1:65536;2:0;4:2097152;5:131072;6:524288|5177345|0|m,s,a,p2458 3:100;4:65536;2:0|1048510465|0|m,s,a,pMatch? Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more . The fingerprint page shows the full measured match list. More on the catalog. 118 3:100;4:10485760;2:0|1048510465|0|m,s,a,pMatch? Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0 . The fingerprint page shows the full measured match list. More on the catalog. 34 3:100;4:33554432;2:0|33488897|0|m,p,s,aMatch? Exact match in Thumbprint's published controlled catalog captures: php-curl 7.88.1, curl 7.88.1 . The fingerprint page shows the full measured match list. More on the catalog. 25 1:4096;2:0;4:65535;5:16384;3:100;6:65536|16777216|0|m,a,s,pMatch? Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1 . The fingerprint page shows the full measured match list. More on the catalog. 10
TCP SYN (p0f)
fingerprint co-occurrences
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01938 4:111+17:0:8365:62727,7:mss,sok,ts,nop,ws:df,id+:01620 4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01564 4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01516 4:112+16:0:8365:62727,7:mss,sok,ts,nop,ws:df,id+:0823 4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0403 4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0368 4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0319 4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:0316 4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0298
TCP SYN (JA4T)
User-Agent
Country
fingerprint co-occurrences
US· United States 8576 SG· Singapore 1947 BR· Brazil 1696 FR· France 1146 VN· Vietnam 1108 ES· Spain 979 GB· United Kingdom 763 CA· Canada 661 IT· Italy 494 SA· Saudi Arabia 439
Network (ASN)
fingerprint co-occurrences
AS14061· DigitalOcean, LLC 2758 AS714· Apple Inc. 2458 AS45102· Alibaba (US) Technology Co., Ltd. 1883 AS45899· VNPT Corp 498 AS7922· Comcast Cable Communications, LLC 497 AS7552· Viettel Group 343 AS3215· Orange S.A. 335 AS7018· AT&T Enterprises, LLC 277 AS12322· Free SAS 277 AS5410· Bouygues Telecom SA 227