QUIC transport params

q12_022106b74856

first seen 2026-06-25 12:13 · last seen 2026-09-16 00:15 · JSON

Last 7 days (3 observations)

Distinct clients per day (last 30 days, peak 5/day)

Distinct clients are counted by IP-hash per complete UTC day — unlike observation counts this is insensitive to one chatty client, but NAT merges clients and address rotation splits them.

Decomposed attributes

Transport-parameter count12
Transport-parameter IDs0001, 0004, 0005, 0006, 0007, 0008, 0009, 000b, 000e, 000f, 0011, 0020
QTP rawq12_0001,0004,0005,0006,0007,0008,0009,000b,000e,000f,0011,0020

Co-observed signals

Signals from other families seen in the same observation. A fingerprint spread thinly across many lower-layer signatures is a classic inconsistency signal.

TLS ClientHello (JA4)

fingerprintco-occurrences
q13d0315h3_55b375c5d22e_dc5437974b47 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +18 more.The fingerprint page shows the full measured match list. More on the catalog.385
q13d0314h3_55b375c5d22e_61e396c58b1f Match?Exact match in Thumbprint's published controlled catalog captures: firefox 132.0, firefox-esr 140.11.0esr, firefox-esr 140.14.0esr, +11 more.The fingerprint page shows the full measured match list. More on the catalog.44
q13d0315h3_55b375c5d22e_bb76f32061e333
q13d0313h3_55b375c5d22e_fc7519ff7bc226
q13d0314h3_55b375c5d22e_1ecea7cb6ec116
q13d0315h3_55b375c5d22e_78345df32b3a10
q13d0313h3_55b375c5d22e_4effff169a466
q13d0316h3_55b375c5d22e_dc4af083c550 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 154.0, firefox 152.0.5, firefox 155.0.1, +6 more.The fingerprint page shows the full measured match list. More on the catalog.2

HTTP request (JA4H)

fingerprintco-occurrences
ge30nr09enus_a060b6642c5e_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 154.0, +22 more.The fingerprint page shows the full measured match list. More on the catalog.53
ge30nr10enus_d6360b5be5ba_000000000000_00000000000033
ge30nr11enus_c87d53636918_000000000000_00000000000025
ge30nr11enus_7eaa533deebc_000000000000_00000000000024
ge30nr11enus_c601de5755fc_000000000000_00000000000023
ge30nn10enus_9fcbd3f1e2d6_000000000000_000000000000 Match?Exact match in Thumbprint's published controlled catalog captures: firefox 153.0, firefox 153.0.3, firefox 152.0.6, +18 more.The fingerprint page shows the full measured match list. More on the catalog.22
ge30nr10enus_9fcbd3f1e2d6_000000000000_00000000000021
ge30nn11enus_7eaa533deebc_000000000000_00000000000019
ge30nn11enus_c87d53636918_000000000000_00000000000017
ge30nr13enus_b80bb85c3fa9_000000000000_00000000000010

User-Agent

fingerprintco-occurrences
Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0107
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.071
Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.058
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.033
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.031
Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.031
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.027
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.016
Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.014
Mozilla/5.0 (Android 15; Mobile; rv:152.0) Gecko/152.0 Firefox/152.010

Country

fingerprintco-occurrences
AU · Australia77
US · United States72
DE · Germany46
FR · France45
IT · Italy28
SE · Sweden23
CA · Canada22
NL · Netherlands21
IN · India17
VN · Vietnam16

Network (ASN)

fingerprintco-occurrences
AS38195 · Superloop62
AS7018 · AT&T Enterprises, LLC18
AS15557 · Societe Francaise Du Radiotelephone - SFR SA17
AS8473 · Bahnhof AB14
AS23889 · Mauritius Telecom Ltd14
AS701 · Verizon Business11
AS3269 · Telecom Italia S.p.A.11
AS3320 · Deutsche Telekom AG10
AS62336 · PURtel.com GmbH10
AS23693 · PT. Telekomunikasi Selular9

Cross-transport links

TLS ClientHello fingerprints observed from the same client via the beacon's correlation id on the other transport (e.g. this stack over TCP ↔ that stack over QUIC).

fingerprintlinked observations
t13d1617h2_86a278354501_3cbfd9057e0d56
t13d1616h2_86a278354501_0c27189014cf55
t13d1616h2_86a278354501_eeeea656296017
t13d1717h2_5b57614c22b0_3cbfd9057e0d17
t13d1614h2_86a278354501_53a6d0ab1c4212
t13d1716h2_5b57614c22b0_0c27189014cf10
t13d1714h2_5b57614c22b0_53a6d0ab1c429
t13d1516h2_8daaf6152771_0c27189014cf9
t13d1517h2_8daaf6152771_3cbfd9057e0d6
t13d1715h2_5b57614c22b0_a54fffd0eb615