TLS supported groups

001d,0017,0018,0019

first seen 2026-10-14 07:05 · last seen 2026-10-31 00:38 · JSON

Last 7 days (316 observations)

Distinct clients per day (last 30 days, peak 62/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order001d (x25519), 0017 (secp256r1), 0018 (secp384r1), 0019 (secp521r1)
Group count4
GREASE count0

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
t13d1712h2_5b57614c22b0_ef7df7f74e48130
t13d4907h2_0d8feac7bc37_7395dae3b2f3 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1.The fingerprint page shows the full measured match list. More on the catalog.77
t13i190800_9dc949149365_97f8aa674fd963
t13d1713h2_5b57614c22b0_02c8e53ee39859
t13i1909h2_9dc949149365_97f8aa674fd958
t13d141100_cbb2034c60b8_e5728521abd452
t13d151000_8daaf6152771_18e8a06d9b2d48
t13d191000_9dc949149365_e7c28522265144
t13d1712h2_5b57614c22b0_d5fe2c511efa25
t13d131100_f57a46bbacb6_e5728521abd421

HTTP request (JA4H)

fingerprintco-occurrences
ge20nn06enus_32386ca2063f_000000000000_000000000000114
ge11nr040000_e1d2031bdfea_000000000000_000000000000106
ge20nn060000_ae91ff777030_000000000000_000000000000100
ge20nn020000_5594a17e7e7e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0, curl 8.13.0, +11 more.The fingerprint page shows the full measured match list. More on the catalog.71
ge11nn040000_8391bea91fb6_000000000000_00000000000045
ge20nr030000_80b089f68b8e_000000000000_00000000000038
ge11nn040000_e1d2031bdfea_000000000000_00000000000033
ge11nr06enus_aeac3047b50b_000000000000_00000000000023
ge11nn050000_a1c329e38462_000000000000_00000000000021
ge20nr030000_ff50983941c1_000000000000_00000000000020

HTTP/2 frames (Akamai)

fingerprintco-occurrences
2:0;1:4096;8:0;3:1024;4:1048576|25100289|0|a,p,m,s214
3:100;4:10485760;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.7.1, curl 8.5.0.The fingerprint page shows the full measured match list. More on the catalog.77
2:0;4:4194304;5:16384;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.26.6, go-net/http 1.26.10, go-net/http 1.26.9, +8 more.The fingerprint page shows the full measured match list. More on the catalog.58
2:0;4:4194304;6:10485760|1073741824|0|a,m,p,s Match?Exact match in Thumbprint's published controlled catalog captures: go-net/http 1.21.13, go-net/http 1.23.12.The fingerprint page shows the full measured match list. More on the catalog.21
0|00|0|m,s,a,p9
2:0;4:4194304;5:1048576;6:65856|1073741824|0|a,m,p,s6
1:65536;2:0;4:6291456;6:262144;4:1048576|15663105|1:0:0:256|m,a,s,p3
3:100;4:65536;2:0|1048510465|0|m,s,a,p Match?Exact match in Thumbprint's published controlled catalog captures: curl 8.13.0, curl 8.18.0, curl 8.21.0, +8 more.The fingerprint page shows the full measured match list. More on the catalog.1
1:65536;2:0;4:131072;5:16384|12517377|3:0:0:42|m,p,a,s Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 152.0.1, +3 more.The fingerprint page shows the full measured match list. More on the catalog.1

TCP SYN (p0f)

fingerprintco-occurrences
4:44+20:0:1368:64860,9:mss,sok,ts,nop,ws:df,id+:061
4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:044
4:43+21:0:1368:64860,9:mss,sok,ts,nop,ws:df,id+:036
4:47+17:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:035
4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:031
4:48+16:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:028
4:46+18:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:022
4:57+7:0:1460:mss*29,12:mss,sok,ts,nop,ws:df,id+:022
4:39+25:0:1418:mss*44,9:mss,sok,ts,nop,ws:df,id+:015
4:44+20:0:1418:mss*44,9:mss,sok,ts,nop,ws:df,id+:014

TCP SYN (JA4T)

fingerprintco-occurrences
64240_2-4-8-1-3_1460_7129
64240_2-4-8-1-3_1418_9113
64860_2-4-8-1-3_1368_9101
42340_2-4-8-1-3_1460_1257
65320_2-4-8-1-3_1420_1044
64240_2-4-8-1-3_1440_736
42340_2-4-8-1-3_1460_1030
64800_2-4-8-1-3_1440_723
64240_2-4-8-1-3_1460_915
64240_2-1-3-1-1-4_1460_813

QUIC transport params

fingerprintco-occurrences
q12_67a81e69c9929
q13_c3e7031b10dc Match?Exact match in Thumbprint's published controlled catalog captures: firefox 155.0.1, firefox 156.0, firefox 155.0, +5 more.The fingerprint page shows the full measured match list. More on the catalog.2

User-Agent

fingerprintco-occurrences
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot114
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot100
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3648
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3648
Mozilla/5.0 zgrab/0.x43
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0 Safari/537.3639
curl/8.7.131
Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)30
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 ModatScanner/1.2 (+https://modat.io/)28
Mozilla/5.022

Country

fingerprintco-occurrences
US · United States302
NL · Netherlands66
BE · Belgium50
DE · Germany38
GB · United Kingdom33
FR · France29
CA · Canada25
AU · Australia17
IN · India17
JP · Japan16

Network (ASN)

fingerprintco-occurrences
AS8075 · Microsoft Corporation250
AS396982 · Google LLC55
AS48090 · TECHOFF SRV LIMITED48
AS20473 · The Constant Company, LLC30
AS209334 · Modat B.V.28
AS50219 · Valence Technology Co.22
AS63949 · Akamai Connected Cloud21
AS10439 · CariNet, Inc.19
AS211298 · Driftnet Ltd18
AS14061 · DigitalOcean, LLC11