TLS supported groups

0a0a,001d,0017,0018

first seen 2026-10-14 06:19 · last seen 2026-10-31 00:53 · JSON

Last 7 days (1463 observations)

Distinct clients per day (last 30 days, peak 680/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order0a0a (GREASE), 001d (x25519), 0017 (secp256r1), 0018 (secp384r1)
Group count4
GREASE count1

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1515h1_8daaf6152771_de4a06bb82e31176
t13d1516h2_8daaf6152771_02713d6af862 Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 134.0.6998.35, chromium 133.0.6943.16.The fingerprint page shows the full measured match list. More on the catalog.1159
t13d1517h2_8daaf6152771_b1ff8ab2d16f381
t13d1515h1_8daaf6152771_0a20fe35d3a5364
t13d181300_e8a523a41297_43ade6aba3df285
t13d1516h2_8daaf6152771_e5627efa2ab1137
t13d1516h1_8daaf6152771_1a63afa7c478132
t13d181200_e8a523a41297_6a3d802a713959
t13d1515h2_8daaf6152771_de4a06bb82e31

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn13enus_9db22d02e17a_000000000000_0000000000001671
ge20nr13enus_e2ac93ffb364_000000000000_0000000000001214
ge20nn12enus_60f823d07c94_000000000000_000000000000399
ge11nn050000_c727097c2f59_000000000000_000000000000164
ge11nn080000_6b4f92f3c7df_000000000000_00000000000099
ge11nn070000_5583da70a3c4_000000000000_00000000000034
ge11nn060000_1726a8486418_000000000000_00000000000034
ge20cr12zhcn_60f823d07c94_000000000000_00000000000016
ge20nr100000_3a9ba06c504b_000000000000_0000000000009
ge11nr09enus_eebd1388f29b_000000000000_0000000000008

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.1524
1:65536;2:0;3:1000;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p124
2:0;4:4194304;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.23.12.The fingerprint page shows the full measured match list. More on the catalog.10
1:65536;3:1000;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p9
1:65536;2:0;3:1000;4:6291456;6:262144|15663105|1:1:0:220|m,a,s,p9
2:0;4:4194304;5:1048576;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.1, go-net/http 1.27.0, go-net/http 1.27.3, +1 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;2:0;3:1000;4:6291456;6:262144|15663105|7:1:0:220|m,a,s,p1

TCP SYN (p0f)

fingerprintco-occurrences
6:43+21:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0586
4:121+7:0:1412:65535,8:mss,sok,ts,nop,ws::0311
6:42+22:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:0176
6:41+23:0:1440:mss*45,7:mss,sok,ts,nop,ws:flow:096
4:50+14:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:060
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:055
4:49+15:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:055
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:054
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:047
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:046

TCP SYN (JA4T)

fingerprintco-occurrences
64800_2-4-8-1-3_1440_7860
65535_2-4-8-1-3_1460_6456
65535_2-4-8-1-3_1412_8363
65535_2-4-8-1-3_1412_6269
65535_2-4-8-1-3_1452_6256
65535_2-4-8-1-3_1440_6190
65535_2-4-8-1-3_1400_6123
64240_2-4-8-1-3_1460_7110
65535_2-4-8-1-3_1460_8102
64240_2-4-8-1-3_1452_770

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36293
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36257
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36246
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36184
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36175
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36174
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36167
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36166
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36166
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36165

Country

fingerprintco-occurrences
US · United States1437
BR · Brazil337
SG · Singapore263
GB · United Kingdom113
VN · Vietnam72
RU · Russia68
AR · Argentina66
MX · Mexico56
FR · France50
PK · Pakistan49

Network (ASN)

fingerprintco-occurrences
AS214483 · FiberPower LLC785
AS15169 · Google LLC344
AS7922 · Comcast Cable Communications, LLC108
AS62610 · Zenlayer Inc97
AS45899 · VNPT Corp41
AS701 · Verizon Business40
AS21928 · T-Mobile USA, Inc.37
AS2856 · British Telecommunications Limited31
AS28573 · Claro NXT Telecomunicacoes Ltda26
AS12389 · PJSC Rostelecom22