TLS supported groups

001d,0017,0018,0019,0100,0101

first seen 2026-10-14 06:36 · last seen 2026-10-30 14:04 · JSON

Last 7 days (125 observations)

Distinct clients per day (last 30 days, peak 23/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order001d (x25519), 0017 (secp256r1), 0018 (secp384r1), 0019 (secp521r1), 0100 (ffdhe2048), 0101 (ffdhe3072)
Group count6
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d3515h1_8f004308c246_5c2c66f702b0247
t13d1713h2_5b57614c22b0_f81080dfc5578
t13d1715h2_5b57614c22b0_3d5424432f577
t13d1714h2_5b57614c22b0_53a6d0ab1c422
t13d1715h2_5b57614c22b0_5c2c66f702b0 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 132.0.The fingerprint page shows the full measured match list. More on the catalog.1
t13d1513h2_8daaf6152771_748f4c70de1c1
t13d1711h2_ab0a1bf427ad_b11bb3600f941

HTTP request (JA4H)

fingerprintco-occurrences
ge11nn050000_a1c329e38462_000000000000_000000000000196
ge11nn050000_3658ef221638_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: wget 1.21.4, wget 1.25.0, wget 1.21.3.The fingerprint page shows the full measured match list. More on the catalog.51
ge20nr11engb_bd1a02c579a6_000000000000_0000000000006
ge20nr09enus_17f45339a253_000000000000_0000000000004
ge20nn10enus_d63c3be3d9d1_000000000000_0000000000002
ge20nr10engb_327edc7bd759_000000000000_0000000000002
ge20nr11enus_187a9385d229_000000000000_0000000000001
ge20nn12enus_a72b71f519fc_000000000000_0000000000001
ge20nn010000_379fadc6c8b7_000000000000_0000000000001
ge20nr13enus_44e1f6d71293_000000000000_0000000000001

HTTP/2 frames (Akamai)

fingerprintco-occurrences
1:65536;4:131072;5:16384|12517377|3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,15:0:13:42|m,p,a,s6
1:65536;4:131072;5:16384|12517377|3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,15:0:11:22|m,p,a,s6
1:65536;2:0;4:131072;5:16384|12517377|3:0:0:22|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 155.0.1, +31 more.The fingerprint page shows the full measured match list. More on the catalog.2
1:65536;2:0;4:131072;5:16384|12517377|1:0:0:42|m,p,a,s1
1:65536;4:131072;5:16384|12517377|3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,17:0:13:42|m,p,a,s1
1:65536;2:0;4:6291456;6:262144;4:1048576|15663105|1:0:0:256|m,a,s,p1
2:0;4:4194304;5:1048576;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.27.1, go-net/http 1.27.0, go-net/http 1.27.3, +1 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;4:131072;5:16384|12517377|3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,23:0:13:42|m,p,a,s1
1:65536;4:131072;5:16384|12517377|3:0:0:201,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1,13:0:0:241,25:0:13:42|m,p,a,s1

TCP SYN (p0f)

fingerprintco-occurrences
6:47+17:0:1440:mss*30,9:mss,sok,ts,nop,ws:flow:0149
6:58+6:0:1440:mss*30,9:mss,sok,ts,nop,ws:flow:050
6:46+18:0:1440:mss*30,9:mss,sok,ts,nop,ws:flow:038
6:57+7:0:1360:65535,13:mss,sok,ts,nop,ws:flow:08
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:06
6:50+14:0:1440:mss*30,9:mss,sok,ts,nop,ws:flow:05
6:58+6:0:1440:mss*45,10:mss,sok,ts,nop,ws:flow:05
4:48+16:0:1440:65535,6:mss,nop,ws,nop,nop,ts,sok,eol+1:df:02
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:01
4:55+9:0:1460:mss*44,10:mss,sok,ts,nop,ws:df,id+:01

TCP SYN (JA4T)

fingerprintco-occurrences
43200_2-4-8-1-3_1440_9242
65535_2-4-8-1-3_1360_138
64240_2-4-8-1-3_1460_77
64800_2-4-8-1-3_1440_106
65535_2-1-3-1-1-8-4-0-0_1440_62
64240_2-4-8-1-3_1460_101
65535_2-4-8-1-3_1452_61

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)247
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.368
Mozilla/5.0 (Android 10; Mobile; rv:89.0) Gecko/89.0 Firefox/89.03
Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.13
Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.02
Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.11
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.01
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_17; rv:109.0) Gecko/20000101 Firefox/109.01

Country

fingerprintco-occurrences
NL · Netherlands106
GB · United Kingdom86
DE · Germany55
US · United States9
CN · China8
AU · Australia1
TH · Thailand1
SI · Slovenia1

Network (ASN)

fingerprintco-occurrences
AS25369 · Hydra Communications Ltd247
AS13335 · Cloudflare, Inc.8
AS4134 · CHINANET BACKBONE6
AS24400 · Shanghai Mobile Communications Co.,Ltd.2
AS38195 · Superloop1
AS8560 · IONOS SE1
AS34779 · T-2, d.o.o.1
AS131090 · National Telecom Public Company Limited1

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
q13d0313h3_55b375c5d22e_fc7519ff7bc22
q13d0314h3_55b375c5d22e_2d2a40a255712