TLS supported groups

0a0a,11ec,001d,0017,0018

first seen 2026-10-14 05:56 · last seen 2026-10-31 00:57 · JSON

Matches controlled captures

Known clients driven through this site's own edge produced this exact fingerprint — measured truth, not inference. catalog → A group list is a TLS-stack trait, so unrelated clients on one library share it, and it says nothing about the group the server chose.

chrome 156.0.8078.73 · Debian 12 · container — 1 session, last 2026-10-27 23:06 controlled
chromium 156.0.8078.47 · Debian 12 · container — 1 session, last 2026-10-27 23:05 controlled
edge 155.0.4283.62 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:08 controlled
chrome 156.0.8078.48 · Windows 10.0.26100.33650 · ci — 1 session, last 2026-10-26 20:08 controlled
chrome 155.0.8059.39 · Ubuntu 24.04 · via chromedriver · ci — 1 session, last 2026-10-26 20:08 controlled
chrome 156.0.8078.47 · Debian 12 · container — 1 session, last 2026-10-20 23:04 controlled
chromium 155.0.8059.79 · Debian 12 · container — 1 session, last 2026-10-20 23:04 controlled
edge 154.0.4258.62 · Windows 10.0.26100.33438 · ci — 1 session, last 2026-10-19 20:08 controlled
chrome 155.0.8059.40 · Windows 10.0.26100.33438 · ci — 1 session, last 2026-10-19 20:08 controlled
chrome 155.0.8059.40 · macOS 26.6.2 · ci — 1 session, last 2026-10-19 20:08 controlled

Last 7 days (2776 observations)

Distinct clients per day (last 30 days, peak 644/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Groups in wire order	`0a0a (GREASE), 11ec (X25519MLKEM768), 001d (x25519), 0017 (secp256r1), 0018 (secp384r1)`
Group count	`5`
GREASE count	`1`

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprint	co-occurrences
`t13d1516h2_8daaf6152771_806a8c22fdea` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 151.0.7922.137, chromium 151.0.7922.34, +28 more.The fingerprint page shows the full measured match list. More on the catalog.	3050
`t13d1516h2_8daaf6152771_d8a2da3f94cd` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 149.0.7827.102, chrome 149.0.7827.102, chrome 149.0.7827.156, +25 more.The fingerprint page shows the full measured match list. More on the catalog.	2440
`t13d1518h2_8daaf6152771_4980c97edce0`	2052
`t13d1517h2_8daaf6152771_cb7bf5808d99` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 152.0.7977.83, chrome 154.0.8037.57, chrome 152.0.7977.64, +24 more.The fingerprint page shows the full measured match list. More on the catalog.	541
`t13d1515h1_8daaf6152771_0a20fe35d3a5`	485
`t13d1516h2_8daaf6152771_02713d6af862` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 134.0.6998.35, chromium 133.0.6943.16.The fingerprint page shows the full measured match list. More on the catalog.	215
`t13i170900_5b57614c22b0_78e6aca7449b`	66
`t13d1516h1_8daaf6152771_d8a2da3f94cd`	23
`t13d1517h2_8daaf6152771_dcad5a053991`	11
`t13d2416h2_d95c37398e29_806a8c22fdea`	9

HTTP request (JA4H)

fingerprint	co-occurrences
`ge20nn13enus_0c2c1d640f3e_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 151.0.7922.137, chrome 151.0.7922.170, chrome 151.0.7922.108, +36 more.The fingerprint page shows the full measured match list. More on the catalog.	4725
`ge20nr12enus_54b4638ab28b_000000000000_000000000000` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chrome 152.0.7977.83, chrome 151.0.7922.137, +58 more.The fingerprint page shows the full measured match list. More on the catalog.	1737
`ge11nn14enus_4a2973d235de_000000000000_000000000000`	485
`ge20nr050000_857b5fa3405d_000000000000_000000000000`	181
`ge20nr050000_277e78b0d503_000000000000_000000000000`	124
`ge20nr050000_bb384e635ab6_000000000000_000000000000`	115
`ge20nn11enus_dbdd560af68b_000000000000_000000000000`	109
`ge20nr050000_7e80a5f53adf_000000000000_000000000000`	109
`ge20nr14enau_3fb598f484fb_000000000000_000000000000`	93
`ge20nn050000_857b5fa3405d_000000000000_000000000000`	70

HTTP/2 frames (Akamai)

fingerprint	co-occurrences
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:256\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 131.0.6778.33, chromium 151.0.7922.34, chrome 151.0.7922.137, +57 more.The fingerprint page shows the full measured match list. More on the catalog.	5050
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chrome 150.0.7871.187, chromium 149.0.7827.102, chrome 152.0.7977.83, +81 more.The fingerprint page shows the full measured match list. More on the catalog.	1192
`2:0;4:4194304;5:16384;6:262144;1:65536\|1073741824\|0\|a,m,p,s`	864
`1:65536;2:0;4:6291456;6:262144\|15663105\|3:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 151.0.7922.34, chromium 147.0.7727.15, chromium 145.0.7632.6, +26 more.The fingerprint page shows the full measured match list. More on the catalog.	429
`1:65536;2:0;4:6291456;6:262144\|15663105\|5:1:0:220\|m,a,s,p` Match?Exact match in Thumbprint's published controlled catalog captures: chromium 133.0.6943.16, chrome 156.0.8078.48, chrome 150.0.7871.128, +3 more.The fingerprint page shows the full measured match list. More on the catalog.	416
`1:65536;2:0;4:6291456;6:262144\|15663105\|3:1:0:256\|m,a,s,p`	50
`1:65536;2:0;4:6291456;6:262144\|15663105\|7:1:0:256\|m,a,s,p`	29
`1:65536;2:0;4:6291456;6:262144\|15663105\|9:1:0:256\|m,a,s,p`	26
`1:65536;2:0;4:6291456;6:262144\|15663105\|5:1:0:256\|m,a,s,p`	24
`1:65536;2:0;4:6291456;6:262144\|15663105\|1:1:0:110\|m,a,s,p`	19

TCP SYN (p0f)

fingerprint	co-occurrences
`4:58+6:0:1420:mss*46,10:mss,sok,ts,nop,ws:df,id+:0`	864
`4:51+13:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	348
`6:57+7:0:1360:65535,13:mss,sok,ts,nop,ws:flow:0`	288
`6:54+10:0:1220:65535,9:mss,sok,ts,nop,ws:flow:0`	267
`4:54+10:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	244
`6:51+13:0:1220:65535,9:mss,sok,ts,nop,ws:flow:0`	180
`4:46+18:0:1250:mss*11,3:mss,sok,ts,nop,ws:df,id+:0`	167
`4:53+11:0:1460:65535,9:mss,sok,ts,nop,ws:df,id+:0`	162
`4:53+11:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	150
`4:49+15:0:1460:mss*44,7:mss,sok,ts,nop,ws:df,id+:0`	143

TCP SYN (JA4T)

fingerprint	co-occurrences
`64240_2-4-8-1-3_1460_7`	1710
`65535_2-4-8-1-3_1220_9`	1057
`65320_2-4-8-1-3_1420_10`	864
`65535_2-4-8-1-3_1460_9`	609
`65535_2-4-8-1-3_1360_13`	590
`65535_2-4-8-1-3_1460_6`	471
`16060_2-4-8-1-3_1250_3`	388
`65535_2-4-8-1-3_1412_6`	356
`65535_2-4-8-1-3_1440_6`	276
`65535_2-4-8-1-3_1452_6`	262

User-Agent

fingerprint	co-occurrences
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36`	2723
`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36`	1091
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36`	700
`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36`	468
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36`	418
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36`	393
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36`	383
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36`	369
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36`	319
`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36`	208

Country

fingerprint	co-occurrences
`US` · United States	4098
`TW` · Taiwan	722
`BR` · Brazil	600
`CN` · China	563
`GB` · United Kingdom	320
`AU` · Australia	168
`DE` · Germany	163
`BE` · Belgium	113
`VN` · Vietnam	103
`RU` · Russia	100

Network (ASN)

fingerprint	co-occurrences
`AS396982` · Google LLC	875
`AS54113` · Fastly, Inc.	856
`AS394192` · Fastly, Inc.	607
`AS13335` · Cloudflare, Inc.	592
`AS62874` · Web2Objects LLC	455
`AS212238` · Datacamp Limited	450
`AS4134` · CHINANET BACKBONE	256
`AS55286` · B2 Net Solutions Inc.	250
`AS18779` · EGIHosting	196
`AS8075` · Microsoft Corporation	139

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprint	linked observations
`q13d0312h3_55b375c5d22e_178839b6cec1`	69
`q13d0311h3_55b375c5d22e_653d80c3fe9d`	49
`q13d0313h3_55b375c5d22e_eb028bd37c08`	6