Week 37 of 2026
The Watchtower from 7 Sep to 13 Sep 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works
- Attack-shaped requests
- 5,167
- Addresses
- 362
- Networks
- 44
- Sites reached
- 35
- Newly blocked
- 0
- Busiest hour (UTC)
- 556 requests
In short
In the week of 7 Sep to 13 Sep 2026 the sensors recorded 5,167 attack-shaped requests from 362 addresses on 44 networks.
They reached 35 sites.
The busiest day was Saturday 12 Sep with 1,785 requests; the quietest, Thursday 10 Sep, had 297.
The busiest single hour began at UTC: 556 requests.
By kind: unclassified 64%, hunting for secrets 31%, scanning 4%.
The single most common request shape, 3,194 times: an address made a request that matched no known pattern.
By sensor: edge 100%.
The busiest network was AS396982 (Google LLC, cloud): 2,518 requests from 227 addresses, 8 of them blocked now.
No new address was blocked on our servers that week.
By day
| Day | Requests | Share |
|---|---|---|
| Monday | 0 | |
| Tuesday | 0 | |
| Wednesday | 458 | |
| Thursday | 297 | |
| Friday | 1,380 | |
| Saturday | 1,785 | |
| Sunday | 1,247 |
What they tried
By kind
| Attack type | Requests | Share |
|---|---|---|
| unclassified | 3,313 | |
| hunting for secrets | 1,618 | |
| scanning | 186 | |
| fake crawlers | 28 | |
| injection | 11 | |
| scanning tools | 10 | |
| known exploits | 1 |
By sensor
| Sensor | Requests | Share |
|---|---|---|
| edge | 5,167 |
Most common request shapes
| Kind of request | Attack type | Requests | Share |
|---|---|---|---|
| Made a request that matched no known pattern | unclassified | 3,194 | |
| Requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | hunting for secrets | 1,488 | |
| Probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | scanning | 136 | |
| Was blocked at the edge without matching any specific attack signature | unclassified | 119 | |
| Requested a .env file, hoping to find API keys or database credentials | hunting for secrets | 53 | |
| Enumerated WordPress REST API post IDs, a common precursor to username/content fingerprinting | scanning | 45 | |
| Claimed to be Googlebot while POSTing, something the real crawler never does | fake crawlers | 28 | |
| Used Vite dev server's @fs/ path to try to read arbitrary files outside the project root | hunting for secrets | 27 | |
| Probed for an exposed .git directory to download the site's source history and config | hunting for secrets | 17 | |
| Requested an AWS credentials file left in a web-accessible path by mistake | hunting for secrets | 12 |
Busiest networks
| Network | Organisation | Type | Addresses | Blocked now | Requests | Share |
|---|---|---|---|---|---|---|
| AS396982 | Google LLC | cloud | 227 | 8 | 2,518 | |
| AS48090 | Techoff Srv Limited | hosting | 28 | 23 | 2,016 | |
| AS142430 | DIGI VPS | hosting | 1 | 1 | 119 | |
| AS215930 | Cipher Operations Doo Beograd - Novi Beograd | home broadband | 5 | 2 | 63 | |
| AS14956 | RouterHosting LLC | hosting | 3 | 2 | 62 | |
| AS63949 | Akamai Connected Cloud | hosting | 11 | 0 | 50 | |
| AS14061 | DigitalOcean, LLC | hosting | 12 | 5 | 42 | |
| AS14618 | Amazon.com, Inc. | cloud | 3 | 0 | 42 | |
| AS208137 | Feo Prest SRL | hosting | 1 | 1 | 30 | |
| AS218785 | Tc Datacenter Limited | hosting | 5 | 2 | 21 |
Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.