I Googled it and I found these two articles that touch on it briefly:

https://www.researchgate.net/figure/Network-level-DNS-Finger...

https://securitytrails.com/blog/cybersecurity-fingerprinting

Is this the kind of tactic you mean?