UDP traffic / QUIC JA4 client fingerprint

q13i0310h3_55b375c5d22e_df5b9e597968

QUIC JA4 client fingerprint. 4 datagrams in the last 30 days, last seen 2026-10-08 16:13 UTC.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Datagrams

Source addresses

Networks

Countries

Destination ports

Traffic by type

QUIC

4 datagrams from 1 source

Initial packets of HTTP/3 connections, decoded on the sensor.

QUIC 4

Latest QUIC datagram, to 443/udp

QUIC v1 Initial alpn=h3,h3-29

Destination ports

443/udp QUIC4

QUIC clients (JA4)

q13i0310h3_55b375c5d22e_df5b9e597968 from 1 source4

QUIC transport parameters

94dccb934778 from 1 source4

QUIC versions

Networks

AS12816 Leibniz-Rechenzentrum from 1 source4

Countries

DE Germany4

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
138.246.253.137	AS12816 Leibniz-Rechenzentrum	DE	QUIC	4	2026-10-08 16:13

Latest datagrams

2026-10-08 16:13:42138.246.253.137to 443/udpQUICDE
QUIC v1 Initial alpn=h3,h3-29
2026-10-08 07:23:08138.246.253.137to 443/udpQUICDE
QUIC v1 Initial alpn=h3,h3-29
2026-10-06 20:32:39138.246.253.137to 443/udpQUICDE
QUIC v1 Initial alpn=h3,h3-29
2026-10-06 17:01:43138.246.253.137to 443/udpQUICDE
QUIC v1 Initial alpn=h3,h3-29

About this fingerprint

JA4 over QUIC fingerprints the TLS ClientHello carried inside a client's QUIC Initial packets, with a q prefix in place of t. Initial packets are encrypted with keys anyone can derive from the packet itself, which is how the sensor reads the ClientHello without answering. The same client library and version produce the same JA4.