cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
← Back to annotator catalog
Protocol anomaly signal illustration
Annotator proto

Protocol anomaly

Request structure or protocol-level signals deviate from typical browser HTTP traffic.

How It Works Recent Real Samples

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.
Focus
  • Malformed HTTP structure and protocol-layer irregularities
  • Header formatting and version anomalies
  • Non-browser request framing that deviates from ordinary traffic
Logic
  • The annotator emits multiple protocol findings when one request breaks several expectations.
  • It is aimed at fuzzers, scanners, and custom clients rather than polished browsers.
  • Signals are sanitized before storage so unusual bytes do not break downstream systems.
How To Read It
This tells you the request was structurally odd at the HTTP layer, not just suspicious in its content.
Catalog Definition
Flags anomalies at the HTTP/protocol layer such as malformed request structure, unusual header formatting/order, invalid versions, or other indicators that the client is not a standard web browser. Useful for spotting scanners, fuzzers, and custom tooling, and for explaining “nonstandard client behavior” in reports.

10 Most Recent Real Samples

Weekly cached from live annotated access events so the catalog stays fast.
Week
2026W13
Lookback
30 days
Total matched
63
Latest sample
Mar 01, 2026 • 23:05
Top rules
proto:bad_percent_encoding · 6 proto:http2_preface_artifact · 3 proto:absolute_form_target · 1
Top requester orgs
Contabo GmbH · 3 Censys, Inc. · 2 DataWagon LLC · 1
Severity mix
12 · 6 10 · 3 11 · 1
Method mix
POST · 5 PRI · 3 \X16\X03\X01\X01 · 1 GET · 1
POST 400 12
Mar 01, 2026 • 23:05
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
Malformed percent-encoding in request target
IP 77.237.243.239 Subnet 77.237.243.0/24 Org Contabo GmbH Country France Rule proto:bad_percent_encoding
\X16\X03\X01\X01 400 12
Mar 01, 2026 • 21:46
\xF8^\xCE\xD2Q-\xE1\xBET\xFE\xA9\xB9OPen\x80\xA7\x83X%W\xAF
Malformed percent-encoding in request target
IP 104.192.2.154 Subnet 104.192.2.0/24 Org DataWagon LLC Country United States Rule proto:bad_percent_encoding
GET 301 11
Mar 01, 2026 • 16:01
/synduen-frontpage
Absolute-form request target observed
IP 14.173.22.254 Subnet 14.173.22.0/24 Org VietNam Post and Telecom Corporation Country Vietnam Rule proto:absolute_form_target
PRI 400 10
Mar 01, 2026 • 15:50
*
HTTP/2 preface artifact (PRI) observed
IP 206.168.34.124 Subnet 206.168.34.0/24 Org Censys, Inc. Country United States Rule proto:http2_preface_artifact
PRI 400 10
Mar 01, 2026 • 10:31
*
HTTP/2 preface artifact (PRI) observed
IP 206.168.34.34 Subnet 206.168.34.0/24 Org Censys, Inc. Country United States Rule proto:http2_preface_artifact
POST 400 12
Mar 01, 2026 • 09:41
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
Malformed percent-encoding in request target
IP 82.24.64.32 Subnet 82.24.64.0/24 Org Arisk Communications inc. Country United Kingdom Rule proto:bad_percent_encoding
POST 400 12
Mar 01, 2026 • 09:20
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
Malformed percent-encoding in request target
IP 178.18.251.208 Subnet 178.18.251.0/24 Org Contabo GmbH Country France Rule proto:bad_percent_encoding
PRI 400 10
Mar 01, 2026 • 02:06
*
HTTP/2 preface artifact (PRI) observed
IP 162.142.125.124 Subnet 162.142.125.0/24 Org Censys Inc Country United States Rule proto:http2_preface_artifact
POST 400 12
Mar 01, 2026 • 01:37
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
Malformed percent-encoding in request target
IP 41.111.128.195 Subnet 41.111.128.0/24 Country Algeria Rule proto:bad_percent_encoding
POST 400 12
Feb 28, 2026 • 23:34
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
Malformed percent-encoding in request target
IP 158.220.100.71 Subnet 158.220.100.0/24 Org Contabo GmbH Country France Rule proto:bad_percent_encoding