Live, aggregated stats from ipthing.net —
who hits a public IP echo service. Charts cover request volume, scanners,
ASN and country mix, TLS, and JA4 fingerprints.
This is a long-running sample of probes and “what’s my IP?” traffic, not a
census of the internet.
Report generated 2026-11-15 06:01 UTC
Dataset at a glance
Requests
145,961
Unique IPs
27,399
First day
2025-07-26
Last day
2026-11-15
HTTPS
11,292
HTTP
73,044
Until Wednesday 23 September 2026 the service only allowed
GET, so historical method mix is almost entirely
GET /. From 19 December 2025 through that same date the
Host header was not recorded either. Scanners still leave
fingerprints in query-parameter names, odd Host/SNI pairs (when
logged), and rare spoofed forwarding headers. See
Probe behaviour below.
IPv6 was only enabled on 25 September 2026; IPv6 client addresses logged
before then are excluded from every figure.
Volume over time
Spikes often align with internet-wide scanning and cloud automation, not only
human “what’s my IP?” visits. Quiet days and noisy days are both informative.
The heatmap is UTC. Scanner traffic often fills nights and weekends; human
browsing tends to cluster in weekday daytime for a given region.
Did they know the name?
We classify each request from the HTTP Host header and TLS SNI
(tls_server_name):
named — ipthing.net (or a subdomain) appears in Host and/or SNI. Strong signal the client resolved or was given the DNS name.
raw IP — Host is a literal IPv4 address (often 159.203.159.64 or an older droplet IP) or a bracketed IPv6 literal such as [2001:db8::1]. Typical of address-space scanners and tools that never looked up the name.
other Host — some other hostname (CDN leftovers, random/spoofed names). Often opportunistic TLS or misdirected probes.
unknown — Host was empty.
Host was not stored from 19 December 2025 until about 14:00 UTC on
23 September 2026, so this section only covers requests since then. For traffic
over the whole period, see Volume over time above.
The daily chart is limited to the same Host-recording window as the donut
(from 23 September 2026). Spikes in raw-IP mode usually track
internet-wide scanning rather than people typing the hostname.
Access mode
Requests
Distinct IPs
raw IP (Host is address)
39,160
4,356
named (ipthing.net)
18,395
2,676
other Host (wrong/spoofed name)
2,733
290
unknown (Host unset)
673
473
Top Host values since 23 September 2026 (including empty) show the same
split in raw form — named traffic clusters on ipthing.net; raw-IP traffic on the
server addresses.
Host header (since 23 Sep 2026)
Requests
ipthing.net
18,107
159.203.159.64
13,560
67.205.178.64
8,743
159.203.159.64:80
8,239
67.205.178.64:80
5,273
94.72.101.19:80
1,684
origin-d.estage.com
1,360
edge-d.estage.com
1,080
94.72.101.19
1,005
(empty)
673
[2604:a880:400:d1:0:5:a92:1001]
442
ipthing.net:80
141
192.0.2.1
128
ipthing.net:443
103
azenv.net
45
[2a02:c204:2373:5161::1]
41
msftncsi.comhttp
29
67-205-178-64.cprapid.com
28
127.0.0.1:80
27
cloudflare.com:443
25
Probe behaviour
Security-oriented shape of the traffic: verbs and paths, query-parameter
names scanners inject, whether clients send spoofed forwarding headers, and
whether HTTP Host matches TLS SNI. Counts only — no raw header
dumps or query values. Only GET was accepted until Wednesday
23 September 2026; other methods in the charts are from that date
onward.
With query params
9,148
Distinct methods
12
Distinct paths
10,164
Non-root paths
45,350
HTTP 404s
45,436
Claimed X-Forwarded-For
2,100
CF-Connecting-IP set
101
XFF ≠ TCP peer
2,100
CF-IP ≠ TCP peer
101
Cookie-bearing
142
ipthing trusts the TCP peer address, not client-supplied forwarding headers.
Non-empty X-Forwarded-For / CF-Connecting-IP that
disagree with the peer are classic spoof attempts (or traffic that really
did pass a proxy). Both are rare here — rarity is the finding.
The method chart and table cover requests from Wednesday
23 September 2026 onward. Only GET was allowed before
that, so earlier rows cannot show other verbs even if clients tried them.
Method
Requests
Share
Distinct IPs
GET
57,124
93.5%
6,702
POST
3,055
5.0%
616
HEAD
501
0.8%
65
PRI
191
0.3%
163
CONNECT
86
0.1%
43
PUT
60
0.1%
22
OPTIONS
49
0.1%
47
DELETE
19
0.0%
10
PROPFIND
17
0.0%
4
PURGE
1
0.0%
1
QUERY
1
0.0%
1
UAYZ
1
0.0%
1
Successful inspector traffic is almost always /. The chart and
table below list the top non-root paths — typically 404 probes
(/.env, WordPress paths, and similar). Those paths are recorded
by ipthing for analytics; they do not get the IP-echo response.
Path
Requests
Distinct IPs
/.env
1,895
298
/SDK/webLanguage
1,029
9
/.aws/config
513
44
/.git/config
426
271
/index.php
342
104
*
191
163
/.git/HEAD
169
95
/.env.local
155
97
/.well-known/security.txt
155
95
/.env.production
154
87
/this_is_a_new_hello_world.php
141
75
/.aws/credentials
134
72
/.env.bak
133
80
/.env.save
124
74
/cgi-bin/../../../../../../../../../../bin/sh
122
88
/xmlrpc.php
121
106
/.env.backup
120
84
/api/.env
116
66
/app/.env
115
66
/phpinfo.php
115
69
Path themes group non-root probes into coarse buckets (secrets, WordPress,
VCS metadata, and so on). The daily chart contrasts successful root hits
with non-root / 404 traffic.
Path theme
Requests
Distinct IPs
other
12,795
1,850
secrets / .env
12,263
521
PHP probes
10,669
564
WordPress
5,086
563
VCS metadata
1,560
373
admin / login
1,098
296
API / actuator
945
257
backups / dumps
651
144
infra / debug
283
106
Query parameter names (not values) are a cheap fingerprint of
vulnerability scanners: phpinfo, rest_route,
file, Xdebug session starters, and similar show up even when
the path is still /.
Host vs SNI: agreement usually means a normal TLS client. Empty SNI with a
Host set is common on plain HTTP. A mismatch
(when both are set) is a stronger opportunistic / misdirected probe signal.
This chart and table cover requests since Host recording resumed on
23 September 2026.
Host / SNI relation
Requests
Distinct IPs
Host set, SNI empty
50,139
5,516
Host and SNI agree
10,129
1,568
both empty
673
473
Host / SNI mismatch
20
20
IPv4 and IPv6
ipthing.net has answered over IPv6 since 25 September 2026. The client address
family comes from the peer IP the service recorded. IPv4-mapped addresses
(::ffff:a.b.c.d) count as IPv4, and loopback (::1,
127.0.0.0/8) from local testing is left out of the chart.
IPv6 requests
928
IPv6 distinct IPs
436
IPv6 share since 25 Sep
1.5%
First IPv6 day
2026-09-25
Family
Requests
Distinct IPs
First day
Last day
IPv4
144,252
26,960
2025-07-26
2026-11-15
IPv6
928
436
2026-09-25
2026-11-15
loopback
782
3
2025-07-26
2026-11-07
The logs also hold IPv6 client addresses from before 25 September 2026,
when IPv6 was not yet enabled. Those rows are treated as unreliable and left out
of the whole report, so every IPv6 figure starts on 25 September 2026.
Org / ASN label (IPv6)
Distinct IPs
Requests
(unknown)
134
321
AS398324 Censys, Inc.
46
140
AS14061 DigitalOcean, LLC
23
112
AS25369 Hydra Communications Ltd
87
90
AS264617 GRUPO PANAGLOBAL 15 S.A
3
64
AS211298 Driftnet Ltd
17
17
AS6939 Hurricane Electric LLC
13
14
AS7922 Comcast Cable Communications, LLC
6
14
AS63949 Akamai Connected Cloud
12
13
AS16509 Amazon.com, Inc.
11
13
AS30860 Virtual Systems LLC
1
11
AS24940 Hetzner Online GmbH
8
8
AS197170 TechTies Inc.
4
8
AS14618 Amazon.com, Inc.
3
8
AS51167 Contabo GmbH
5
6
Outcomes and latency
Status codes and response formats show how the service answered. Latency is
only available on newer rows where duration was recorded.
With duration
60,961
p50 ms
0
p95 ms
422
p99 ms
772
Status
Requests
Distinct IPs
(unset / older rows)
85,048
22,105
404
45,436
2,972
200
15,476
5,149
413
2
1
Response format
Requests
Distinct IPs
(unset / older rows)
85,001
22,092
error
45,438
2,972
html
13,678
4,266
json
1,845
1,021
Where clients appear to be
Country and org come from a geolocation cache (ipinfo-style fields) keyed by IP.
Cloud and CDN ASNs dominate because scanners, health checks, and hosted tools
live there — not because “most humans” do.
Country
Distinct IPs
US
11,038
(unknown)
4,611
NL
1,907
DE
1,608
GB
1,397
BE
1,153
SG
989
CN
814
CA
787
FR
709
HK
424
IN
386
BR
342
JP
338
SE
313
RU
311
ID
183
AU
165
TW
160
FI
158
Which networks show up most
High ranks for DigitalOcean, Google, Cloudflare, Amazon, Microsoft, and
Censys are expected for a reachable reflector: research scanners, bots, and
cloud VMs check such hosts continuously.
Org / ASN label
Distinct IPs
(unknown)
4,623
AS14061 DigitalOcean, LLC
3,137
AS396982 Google LLC
2,813
AS13335 Cloudflare, Inc.
2,249
AS14618 Amazon.com, Inc.
1,334
AS16509 Amazon.com, Inc.
1,105
AS8075 Microsoft Corporation
1,051
AS25369 Hydra Communications Ltd
796
AS45102 Alibaba (US) Technology Co., Ltd.
735
AS16276 OVH SAS
697
AS132203 Tencent Building, Kejizhongyi Avenue
645
AS398324 Censys, Inc.
555
AS63949 Akamai Connected Cloud
478
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
386
AS211298 Driftnet Ltd
312
AS213412 ONYPHE SAS
281
AS15169 Google LLC
184
AS9009 M247 Europe SRL
178
AS211680 NSEC - Sistemas Informaticos, S.A.
161
AS4837 CHINA UNICOM China169 Backbone
158
TLS and HTTP versions
Modern stacks prefer TLS 1.3, HTTP/2, and AEAD cipher suites. Newer rows also
record key-exchange curve and whether the TLS session resumed. Older protocols,
empty ALPN fields, and unset curves still appear from legacy clients, plain HTTP,
and rows logged before those columns existed.
TLS resume rate
1.2%
Rows with resume flag
57,941
Any PTR resolved
4.0%
mTLS subject present
0.0%
PTR and mTLS cards are presence rates only — reverse-DNS hostnames and client
certificate subjects are identifying and are never listed here. Session resume
is measured only on rows where tls_did_resume is set (NULLs from
older traffic are excluded from the rate).
Cipher suite
Requests
TLS_AES_128_GCM_SHA256 (4865)
10,533
TLS_CHACHA20_POLY1305_SHA256 (4867)
568
ECDHE_ECDSA_AES_128_GCM_SHA256 (49195)
191
ECDHE_ECDSA_CHACHA20_POLY1305 (52393)
1
TLS curve
Requests
(unset)
74,846
X25519MLKEM768
4,807
X25519
4,571
CurveP256
84
CurveP384
28
CurveP521
1
ClientHello fingerprints (JA4 / JA3)
JA4 and JA3 summarise the TLS ClientHello — cipher order, extensions, ALPN —
into a hash shared by many clients with the same stack. They describe
software clusters (browser-like vs bot-like shapes), not people.
Charts show frequency and uniqueness only; hashes are never joined back to
individual IPs on this page.
Requests with JA4
9,491
Distinct JA4
207
JA4 coverage
6.5%
Requests with JA3
9,491
Distinct JA3
686
Shape buckets parse the JA4 first segment (TLS version, SNI present/absent,
ALPN). “Browser-like” usually means TLS 1.3 + SNI + h2/h3; “no-SNI” and
empty ALPN lean scanner/automation. This is a coarse heuristic for mix, not
attribution.
JA4 shape
Requests
Distinct JA4
empty/odd ALPN
4,734
85
browser-like (TLS1.3 + SNI + h2/h3)
3,428
64
other / uncommon
1,288
52
legacy-browser-like (TLS1.2 + SNI)
41
6
JA4 hash
Requests
Distinct IPs
t13d201100_2b729b4bf6f3_36bf25f296df
1,496
22
t13d131100_f57a46bbacb6_e5728521abd4
993
49
t13d1516h2_8daaf6152771_d8a2da3f94cd
949
63
t13d131100_f57a46bbacb6_ab7e3b40a677
773
189
t13d3112h1_e8f1e7e78f70_b26ce05bbdd6
498
4
t13d1312h2_f57a46bbacb6_ab7e3b40a677
425
24
t13d4312h1_c7886603b240_b26ce05bbdd6
351
16
t13d1011h2_61a7ad8aa9b6_d4929ced8316
330
2
t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
233
15
t13d1115h2_c5d436628c5c_934397ce148c
225
30
t13d1314h2_f57a46bbacb6_fb48f8b98a29
224
4
t13d1312h2_a44d0ee8b3cc_e381dae6da6b
200
39
t13d431000_c7886603b240_1f22a2ca17c4
171
2
t13d171200_ab0a1bf427ad_ecd0401ec68b
141
140
t13d141100_cbb2034c60b8_e5728521abd4
139
8
JA3 hash
Requests
Distinct IPs
235e96666b815e9c04b92655fc6ea700
1,656
185
fa4ec55a45018e3dd5a3400b2d3bef69
1,493
20
28b304b1cf203cc029dd4ad810a2fa5f
517
20
ae49556c64fbbbd36f6e0f21d79343bf
463
25
3c65de2018218cc89951197a78ade399
351
16
b6db1b6da473162c81103f755c8bcf39
225
30
531066ee9e75168a1f2633bab7ced64d
223
3
0f96e7aa147f902bb0e7d6f24ff210ed
200
39
f35b3db7394fa8af84282ff4b02b0c81
171
2
551233849fc2dd5f0d65715ace331075
150
44
8e8b4a0763d06e039f0474ae0128f99a
141
140
a198fa2c43bdbadb40499ca3cabee9c5
139
8
Referers
Most hits have no Referer (direct tools and scanners). When one
is present, only the hostname is shown — not the full URL.
With Referer
7,094
Without Referer
138,868
Referer host
Requests
Distinct IPs
(none)
138,868
25,450
159.203.159.64
2,010
4
www.ipthing.net
1,091
358
67.205.178.64:80
558
44
www.google.com
430
372
159.203.159.64:80
425
51
ipthing.net
368
156
(opaque / non-http)
290
90
twitter.com
177
177
news.ycombinator.com
163
163
duckduckgo.com
158
158
t.co
153
153
www.bing.com
150
150
www.facebook.com
147
147
edge-d.estage.com
136
2
www.ipthing.net:80
132
5
www.reddit.com
131
131
217.60.242.10:8008
81
1
www.netcraft.com
68
31
www.ipthing.net:443
66
6
Client flavour (User-Agent heuristics)
Buckets are coarse string heuristics, not a security product. They separate
browser-like families from curl/scripts and explicit bot UAs so the report
can talk about mix without publishing raw User-Agent strings.
Most common class
Chrome-like
Share of requests
31.9%
Requests in class
46,548
Distinct IPs in class
10,177
Classes seen
13
UA class
Requests
Share
Distinct IPs
Chrome-like
46,548
31.9%
10,177
bot / scanner UA
20,133
13.8%
5,652
Safari-like
16,060
11.0%
2,478
Edge-like
15,997
11.0%
714
empty
14,018
9.6%
2,560
other browser-like
11,509
7.9%
3,297
Firefox-like
9,916
6.8%
2,585
curl
3,372
2.3%
771
other
2,703
1.9%
676
Go HTTP client
2,063
1.4%
1,251
Opera-like
1,660
1.1%
247
Python HTTP clients
1,601
1.1%
726
wget
381
0.3%
8
“Most common” means the largest heuristic class by request count, not a
single literal User-Agent string. Raw UA text is never listed here.
How to read this responsibly
Selection bias: only hosts that chose (or were pointed at) ipthing.
Geo/ASN labels are best-effort and can lag or mis-attribute shared IPs.
Public pages stay aggregated: no raw headers, full User-Agents tied to clients, PTR hostnames, mTLS subjects, or cookie values. Fingerprints are hash frequency / clusters only.
Query and cookie names may appear as top-N tokens; values are out of scope.