UDP traffic / QUIC JA4 client fingerprint

q13i0207h9_62ed6f6ca7ad_95b521733d99

QUIC JA4 client fingerprint. 17 datagrams in the last 30 days, last seen 2026-10-11 17:26 UTC.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

QUIC

17 datagrams from 17 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 17

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=h3-29,h3

Destination ports

443/udp QUIC10
8443/udp QUIC7

QUIC clients (JA4)

q13i0207h9_62ed6f6ca7ad_95b521733d99 from 17 sources17

QUIC transport parameters

4c2cac1ef1cb from 17 sources17

QUIC versions

Networks

AS211298 Driftnet Ltd from 17 sources17

Countries

GB United Kingdom17

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
195.96.139.190	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 00:59
195.96.139.149	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 01:10
195.96.139.150	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 05:59
87.236.176.249	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:41
87.236.176.248	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-08 18:32
185.247.137.251	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-11 10:21
87.236.176.230	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-09 05:54
195.96.139.42	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-07 01:50
87.236.176.227	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-08 04:40
87.236.176.38	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 08:18
195.96.139.94	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:23
87.236.176.148	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-07 09:01
195.96.139.124	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-09 00:37
185.247.137.165	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 09:53
185.247.137.174	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-11 17:26
87.236.176.245	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 10:19
185.247.137.73	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-08 17:12

Latest datagrams

2026-10-11 17:26:10185.247.137.174to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-11 10:21:32185.247.137.251to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-10 18:23:47195.96.139.94to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-10 11:41:5587.236.176.249to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-10 05:59:03195.96.139.150to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-09 05:54:2487.236.176.230to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-09 00:37:48195.96.139.124to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-08 18:32:5387.236.176.248to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-08 17:12:30185.247.137.73to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-08 04:40:2687.236.176.227to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-07 09:01:3487.236.176.148to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-07 01:50:09195.96.139.42to 443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-06 10:19:0187.236.176.245to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-06 09:53:47185.247.137.165to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3
2026-10-06 08:18:2287.236.176.38to 8443/udpQUICGB
QUIC v1 Initial alpn=h3-29,h3

About this fingerprint

JA4 over QUIC fingerprints the TLS ClientHello carried inside a client's QUIC Initial packets, with a q prefix in place of t. Initial packets are encrypted with keys anyone can derive from the packet itself, which is how the sensor reads the ClientHello without answering. The same client library and version produce the same JA4.