QUIC transport params

q14_77ff2fdc8292

first seen 2026-07-05 13:24 · last seen 2026-10-24 06:50 · JSON

Distinct clients per day (last 30 days, peak 1/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Transport-parameter count14
Transport-parameter IDs0001, 0004, 0005, 0006, 0007, 0008, 0009, 000b, 000c, 000e, 000f, 0020, 2ab2, ff73db
QTP rawq14_0001,0004,0005,0006,0007,0008,0009,000b,000c,000e,000f,0020,2ab2,ff73db

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
q13d0314h3_55b375c5d22e_2d2a40a255712

HTTP request (JA4H)

fingerprintco-occurrences
ge30nr09enus_ec2dd7bc6eab_000000000000_0000000000002

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/115.01
Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Mobile/15E148 Safari/604.11

Country

fingerprintco-occurrences
CN · China1
EE · Estonia1

Network (ASN)

fingerprintco-occurrences
AS4134 · CHINANET BACKBONE1
AS3249 · Telia Eesti AS1

TLS supported groups

fingerprintco-occurrences
001d,0017,0018,0019,0100,0101,0102,0103,01041

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
t13d1715h2_5b57614c22b0_3d5424432f574