UDP traffic / QUIC JA4 client fingerprint

q13i0308h3_55b375c5d22e_bc854dc9d3af

QUIC JA4 client fingerprint. 15 datagrams in the last 30 days, last seen 2026-10-10 18:25 UTC.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

QUIC

15 datagrams from 15 sources

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 15

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=h3,h3-29

Destination ports

443/udp QUIC8
8443/udp QUIC7

QUIC clients (JA4)

q13i0308h3_55b375c5d22e_bc854dc9d3af from 15 sources15

QUIC transport parameters

60647680e335 from 15 sources15

QUIC versions

Networks

AS211298 Driftnet Ltd from 15 sources15

Countries

GB United Kingdom15

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
195.96.139.96	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 18:25
87.236.176.250	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 10:20
195.96.139.224	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-09 05:55
195.96.139.223	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 11:43
87.236.176.180	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-10 06:00
195.96.139.49	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-07 01:51
185.247.137.72	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-08 17:13
87.236.176.165	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 01:11
195.96.139.121	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-09 00:39
87.236.176.34	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-09 06:39
185.247.137.181	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-07 09:02
185.247.137.196	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 01:01
185.247.137.219	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-08 18:34
87.236.176.44	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-06 08:19
87.236.176.241	AS211298 Driftnet Ltd	GB	QUIC	1	2026-10-08 04:41

Latest datagrams

2026-10-10 18:25:04195.96.139.96to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-10 11:43:11195.96.139.223to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-10 06:00:1987.236.176.180to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-09 06:39:1387.236.176.34to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-09 05:55:40195.96.139.224to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-09 00:39:04195.96.139.121to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-08 18:34:09185.247.137.219to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-08 17:13:46185.247.137.72to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-08 04:41:4387.236.176.241to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-07 09:02:50185.247.137.181to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-07 01:51:25195.96.139.49to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-06 10:20:1787.236.176.250to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-06 08:19:3887.236.176.44to 8443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-06 01:11:3287.236.176.165to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29
2026-10-06 01:01:06185.247.137.196to 443/udpQUICGB
QUIC v1 Initial alpn=h3,h3-29

About this fingerprint

JA4 over QUIC fingerprints the TLS ClientHello carried inside a client's QUIC Initial packets, with a q prefix in place of t. Initial packets are encrypted with keys anyone can derive from the packet itself, which is how the sensor reads the ClientHello without answering. The same client library and version produce the same JA4.