TLS supported groups

0a0a,6399,001d,0017,0018

first seen 2026-10-14 13:40 · last seen 2026-10-31 00:23 · JSON

Last 7 days (146 observations)

Distinct clients per day (last 30 days, peak 65/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order0a0a (GREASE), 6399 (X25519Kyber768Draft00 (OBSOLETE)), 001d (x25519), 0017 (secp256r1), 0018 (secp384r1)
Group count5
GREASE count1

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1516h2_8daaf6152771_02713d6af862 Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 134.0.6998.35, chromium 133.0.6943.16.The fingerprint page shows the full measured match list. More on the catalog.186
t13d1515h1_8daaf6152771_0a20fe35d3a5168

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn14enus_4a2973d235de_000000000000_000000000000168
ge20nn13enus_0c2c1d640f3e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: chrome 151.0.7922.137, chrome 151.0.7922.170, chrome 151.0.7922.108, +36 more.The fingerprint page shows the full measured match list. More on the catalog.163
ge20nr100000_cd21bc802353_000000000000_00000000000010
ge20nr12dede_f373c1189b47_000000000000_0000000000006
ge20nn110000_5f26d954e309_000000000000_0000000000003
ge20nr12enus_f373c1189b47_000000000000_0000000000002
ge20nn13dede_0c2c1d640f3e_000000000000_0000000000002

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:256|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.166
1:65536;2:0;4:6291456;6:262144|15663105|1:1:0:220|m,a,s,p Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 152.0.7977.83, +81 more.The fingerprint page shows the full measured match list. More on the catalog.12
1:65536;2:0;4:6291456;6:262144;64026:606064379|15663105|1:1:0:256|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;47866:2645542512|15663105|1:1:0:220|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;51754:1062186365|15663105|1:1:0:220|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;6906:2168536383|15663105|1:1:0:220|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;64090:798614204|15663105|1:1:0:220|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;35482:2005955479|15663105|1:1:0:256|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;64186:4056359346|15663105|1:1:0:220|m,a,s,p1
1:65536;2:0;4:6291456;6:262144;2586:1825113091|15663105|1:1:0:220|m,a,s,p1

TCP SYN (p0f)

fingerprintco-occurrences
4:57+7:0:1420:mss*46,7:mss,sok,ts,nop,ws:df,id+:013
4:48+16:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:010
6:111+17:0:1440:mss*44,8:mss,nop,ws,nop,nop,sok::08
4:51+13:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:07
4:46+18:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:07
4:47+17:0:1452:65535,6:mss,sok,ts,nop,ws:df,id+:06
4:47+17:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:06
4:52+12:0:1460:65535,6:mss,sok,ts,nop,ws:df,id+:06
4:48+16:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:05
4:44+20:0:1440:65535,6:mss,sok,ts,nop,ws:df,id+:05

TCP SYN (JA4T)

fingerprintco-occurrences
65535_2-4-8-1-3_1460_663
65535_2-4-8-1-3_1412_637
65535_2-4-8-1-3_1452_630
65535_2-4-8-1-3_1440_628
65535_2-4-8-1-3_1400_616
64240_2-4-8-1-3_1452_714
64240_2-4-8-1-3_1460_713
65320_2-4-8-1-3_1420_713
65535_2-4-8-1-3_1460_811
64240_2-1-3-1-1-4_1440_810

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36331
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.24613
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.368
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.362

Country

fingerprintco-occurrences
US · United States70
BR · Brazil40
GB · United Kingdom22
VN · Vietnam16
DE · Germany11
MA · Morocco11
ES · Spain8
TR · Turkey8
AR · Argentina7
CA · Canada6

Network (ASN)

fingerprintco-occurrences
AS396982 · Google LLC13
AS7922 · Comcast Cable Communications, LLC10
AS3209 · Vodafone GmbH9
AS45899 · VNPT Corp9
AS5607 · Sky UK Limited8
AS6057 · Administracion Nacional de Telecomunicaciones6
AS36903 · Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM5
AS2856 · British Telecommunications Limited5
AS18403 · FPT Telecom Company5
AS36925 · MEDITELECOM5

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
q13d0311h3_55b375c5d22e_5a1f323ef56d2