UDP traffic / QUIC JA4 client fingerprint
q13i0213sb_62ed6f6ca7ad_03ad308c6343
QUIC JA4 client fingerprint. 3 datagrams in the last 30 days, last seen 2026-10-07 18:46 UTC.
A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.
3
Datagrams
3
Source addresses
3
Networks
1
Countries
1
Destination ports
Traffic by type
QUIC
3 datagrams from 3 sourcesInitial packets of HTTP/3 connections, decoded on the sensor.
Latest QUIC datagram, to 443/udp
Destination ports
- 443/udp QUIC3
QUIC clients (JA4)
- q13i0213sb_62ed6f6ca7ad_03ad308c6343 from 3 sources3
QUIC transport parameters
- 5826be32c2d4 from 2 sources2
- 24dc672a03ab from 1 source1
QUIC versions
- 13
Networks
- AS29470 JSC RetnNet from 1 source1
- AS3216 PVimpelCom from 1 source1
- AS24955 JSC Ufanet from 1 source1
Countries
Source addresses (unverified)
| Address | Network | Cc | Sends | Datagrams | Last seen (UTC) |
|---|---|---|---|---|---|
| 46.46.137.198 | AS29470 JSC RetnNet | RU | QUIC | 1 | 2026-10-07 18:46 |
| 62.105.128.170 | AS3216 PVimpelCom | RU | QUIC | 1 | 2026-10-07 10:56 |
| 94.41.245.248 | AS24955 JSC Ufanet | RU | QUIC | 1 | 2026-10-07 15:11 |
Latest datagrams
About this fingerprint
JA4 over QUIC fingerprints the TLS ClientHello carried inside a client's QUIC Initial packets, with a q prefix in place of t. Initial packets are encrypted with keys anyone can derive from the packet itself, which is how the sensor reads the ClientHello without answering. The same client library and version produce the same JA4.