TLS supported groups

0017,0019,0018,0016

first seen 2026-10-14 11:54 · last seen 2026-10-30 15:15 · JSON

Last 7 days (19 observations)

Distinct clients per day (last 30 days, peak 6/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order0017 (secp256r1), 0019 (secp521r1), 0018 (secp384r1), 0016 (secp256k1)
Group count4
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t12d4906h1_730fb1b0ac6a_22a92d800fe429
t12d490600_730fb1b0ac6a_a1e93568279518
t12d650700_0dd215169a35_4446390ac2241

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn07zhcn_ad6bb88d6320_000000000000_00000000000030
ge11nn050000_b223a0ebb0b5_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: python-requests 2.34.2, python-requests 2.33.1, python-requests 2.32.3.The fingerprint page shows the full measured match list. More on the catalog.17
ge11nn040000_17807bc4167d_000000000000_0000000000001

TCP SYN (p0f)

fingerprintco-occurrences
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:016
4:34+30:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:015
4:41+23:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:08
4:35+29:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:04
4:45+19:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:03
4:48+16:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01
4:55+9:0:1460:mss*20,7:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
29200_2-4-8-1-3_1460_732
42340_2-4-8-1-3_1460_1216

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.3617
Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)11
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/601.1.2710
libwww-perl/6.051
Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15G77 MicroMessenger/6.6.5 NetType/4G Language/zh_CN1
Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9) Gecko/2008062908 Firefox/3.0 (Debian-3.0~rc2-2)1
Mozilla/5.0 (Linux; Android 7.0; KNT-AL20 Build/HUAWEIKNT-AL20; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044205 Mobile Safari/537.36 MicroMessenger/6.6.7.1321(0x26060739) NetType/WIFI Language/zh_CN1
Mozilla/5.0 (Linux; Android 6.0.1; vivo X9 Build/MMB29M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044205 Mobile Safari/537.36 MicroMessenger/6.7.2.1340(0x26070236) NetType/4G Language/en1
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.8 (KHTML, like Gecko) Chrome/17.0.940.0 Safari/535.81
Mozilla/5.0 (X11; U; Linux x86_64; pl-PL; rv:2.0) Gecko/20110307 Firefox/4.01

Country

fingerprintco-occurrences
CN · China30
NL · Netherlands18

Network (ASN)

fingerprintco-occurrences
AS58461 · CT HangZhou IDC19
AS49870 · Alsycon B.V.18
AS4811 · China Telecom (Group)8
AS4134 · CHINANET BACKBONE3