TLS supported groups

0a0a,001d,0017,0018,0019

first seen 2026-10-16 01:47 · last seen 2026-11-01 00:09 · JSON

Last 7 days (5 observations)

Distinct clients per day (last 30 days, peak 20/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order0a0a (GREASE), 001d (x25519), 0017 (secp256r1), 0018 (secp384r1), 0019 (secp521r1)
Group count5
GREASE count1

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d2014h2_a09f3c656075_e42f34c56612 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.5, safari 26.6.1, +2 more.The fingerprint page shows the full measured match list. More on the catalog.37
q13d0311h3_55b375c5d22e_f2a83c8e78ae Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.1.2, urlsession 6.3.3, +6 more.The fingerprint page shows the full measured match list. More on the catalog.3
t13d2014h2_a09f3c656075_14788d8d241b3
t13d2015h2_a09f3c656075_c258b721e4903
t13d2613h2_2802a3db6c62_845d286b0d671

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn08enus_1945e0741196_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.4.The fingerprint page shows the full measured match list. More on the catalog.23
ge20nr09zhcn_538441e4e116_000000000000_0000000000006
ge20nn08zhcn_1945e0741196_000000000000_0000000000005
ge20nr09zhcn_935a4c186404_000000000000_0000000000004
ge20nr08enus_1945e0741196_000000000000_0000000000002
ge20nn09zhcn_547aba124fbf_000000000000_0000000000002
ge20nn030000_6dac75bd47eb_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-httpx 0.28.1.The fingerprint page shows the full measured match list. More on the catalog.1
ge30nn07enus_77221925c655_000000000000_0000000000001
ge30nn09zhcn_547aba124fbf_000000000000_0000000000001
ge30nr09zhcn_538441e4e116_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;3:100;4:2097152;9:1|10420225|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, safari 26.6.2, safari 26.5, +3 more.The fingerprint page shows the full measured match list. More on the catalog.29
2:0;3:100;4:2097152;9:1|10420225|1:0:0:256|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2.The fingerprint page shows the full measured match list. More on the catalog.10
2:0;3:100;4:2097152;8:1;9:1|10420225|0|m,s,a,p2
4:4194304;3:100|10485760|1:1:0:256|m,s,p,a1
2:0;4:4194304;5:1048576;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.1, go-net/http 1.27.3, go-net/http 1.27.0, +1 more.The fingerprint page shows the full measured match list. More on the catalog.1
2:0;3:100;4:2097152;9:1|10420225|3:0:0:256|m,s,a,p1

TCP SYN (p0f)

fingerprintco-occurrences
4:53+11:0:1424:mss*44,7:mss,sok,ts,nop,ws:df,id+:08
4:56+8:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:05
6:57+7:0:1440:65535,10:mss,sok,ts,nop,ws:flow:03
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:44+20:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:52+12:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:43+21:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:02
4:114+14:0:1336:65535,8:mss,nop,ws,nop,nop,sok:df,id+:02
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_719
64240_2-4-8-1-3_1424_78
65535_2-4-8-1-3_1440_103
64800_2-4-8-1-3_1440_102
64240_2-4-8-1-3_1400_72
65535_2-4-8-1-3_1440_62
65535_2-1-3-1-1-4_1336_82
65535_2-4-8-1-3_1412_61
64800_2-1-3-1-1-4_1440_81
65535_2-1-3-1-1-8-4-0-0_1300_61

QUIC transport params

fingerprintco-occurrences
q08_52ebd28059b7 Match?Exact match in Thumbprint's published controlled catalog captures: safari 26.5.2, urlsession 6.1.2, safari 26.5, +2 more.The fingerprint page shows the full measured match list. More on the catalog.3

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Safari/605.1.1520
Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.5 Mobile/15E148 Safari/604.119
Mozilla/5.0 (iPhone; CPU iPhone OS 26_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.13
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.152
Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.11
tls-client/1.0.11
Hydra/27 CFNetwork/3826.500.131 Darwin/24.5.01

Country

fingerprintco-occurrences
US · United States16
HK · Hong Kong SAR China12
CN · China4
BR · Brazil3
CH · Switzerland2
EE · Estonia2
RO · Romania1
MX · Mexico1
PL · Poland1
ES · Spain1

Network (ASN)

fingerprintco-occurrences
AS132203 · Tencent Building, Kejizhongyi Avenue8
AS3257 · GTT Communications Inc.4
AS4837 · CHINA UNICOM China169 Backbone4
AS63199 · CDS Global Cloud Co., Ltd4
AS9009 · M247 Europe SRL3
AS30058 · FDCservers.net3
AS212238 · Datacamp Limited2
AS13030 · Init7 (Switzerland) Ltd.2
AS34702 · Aktsiaselts WaveCom2
AS22773 · Cox Communications Inc.1

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
t13d2014h2_a09f3c656075_e42f34c566121
q13d0311h3_55b375c5d22e_f2a83c8e78ae1