QUIC transport params
q14_cd6c5d184a1a
first seen 2026-10-17 22:55 · last seen 2026-10-17 22:55 · JSON
Distinct clients per day (last 30 days, peak 1/day)
Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.
Decomposed attributes
| Transport-parameter count | 14 |
|---|---|
| Transport-parameter IDs | 0001, 0004, 0005, 0006, 0007, 0008, 0009, 000b, 000e, 000f, 0011, 001d, 0020, 2ab2 |
| QTP raw | q14_0001,0004,0005,0006,0007,0008,0009,000b,000e,000f,0011,001d,0020,2ab2 |
Co-observed signals
Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.
TLS ClientHello (JA4)
| fingerprint | co-occurrences |
|---|---|
q13d0314h3_55b375c5d22e_29443802b1e4 | 3 |
HTTP request (JA4H)
| fingerprint | co-occurrences |
|---|---|
ge30nr12enus_35ca41c56357_000000000000_000000000000 | 1 |
ge30nr11enus_c601de5755fc_000000000000_000000000000 | 1 |
ge30nn12enus_35ca41c56357_000000000000_000000000000 | 1 |
User-Agent
| fingerprint | co-occurrences |
|---|---|
Mozilla/5.0 (Android 10; Mobile; rv:158.0) Gecko/158.0 Firefox/158.0 | 3 |
Country
| fingerprint | co-occurrences |
|---|---|
NL · Netherlands | 3 |
Network (ASN)
| fingerprint | co-occurrences |
|---|---|
AS43350 · NForce Entertainment B.V. | 3 |
TLS supported groups
| fingerprint | co-occurrences |
|---|---|
11ec,001d,0017,0018,0019,0202,0a0a | 3 |
Cross-transport links
TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).
| fingerprint | linked observations |
|---|---|
t13d1514h2_8daaf6152771_117163924e76 | 1 |