Week 38 of 2026
The Watchtower from 14 Sep to 20 Sep 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works
← Week 37 of 2026 · All weeks · Week 39 of 2026 → · Atom feed
- Attack-shaped requests
- 9,386+4,219 (+82%) on the week before
- Addresses
- 602+240 (+66%) on the week before
- Networks
- 61
- Sites reached
- 36+1 (+3%) on the week before
- Newly blocked
- 0same as the week before
- Busiest hour (UTC)
- 802 requests
In short
In the week of 14 Sep to 20 Sep 2026 the sensors recorded 9,386 attack-shaped requests from 602 addresses on 61 networks.
They reached 36 sites.
The busiest day was Sunday 20 Sep with 3,539 requests; the quietest, Thursday 17 Sep, had 518.
The busiest single hour began at UTC: 802 requests.
By kind: hunting for secrets 47%, unclassified 46%, scanning 5%.
The single most common request shape, 4,194 times: an address made a request that matched no known pattern.
By sensor: edge 70%, web 30%.
The busiest network was AS396982 (Google LLC, cloud): 5,248 requests from 387 addresses, 36 of them blocked now.
No new address was blocked on our servers that week.
Against the week before: requests 5,167 to 9,386 (+82%), addresses 362 to 602 (+66%), new blocks unchanged at 0.
By day
| Day | Requests | Share |
|---|---|---|
| Monday | 1,073 | |
| Tuesday | 1,219 | |
| Wednesday | 586 | |
| Thursday | 518 | |
| Friday | 1,164 | |
| Saturday | 1,287 | |
| Sunday | 3,539 |
What they tried
By kind
| Attack type | Requests | Share |
|---|---|---|
| hunting for secrets | 4,366 | |
| unclassified | 4,339 | |
| scanning | 474 | |
| injection | 173 | |
| fake crawlers | 27 | |
| scanning tools | 4 | |
| password spraying | 3 |
By sensor
| Sensor | Requests | Share |
|---|---|---|
| edge | 6,589 | |
| web | 2,797 |
Most common request shapes
| Kind of request | Attack type | Requests | Share |
|---|---|---|---|
| Made a request that matched no known pattern | unclassified | 4,194 | |
| Requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | hunting for secrets | 1,856 | |
| Requested a .env file, hoping to find API keys or database credentials | hunting for secrets | 1,848 | |
| Probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | scanning | 211 | |
| Requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | hunting for secrets | 202 | |
| Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root | injection | 173 | |
| Was blocked at the edge without matching any specific attack signature | unclassified | 145 | |
| Enumerated WordPress REST API post IDs, a common precursor to username/content fingerprinting | scanning | 126 | |
| Requested phpinfo.php, which dumps the full PHP configuration and environment if left in place | hunting for secrets | 125 | |
| Fuzzed a short, random filename looking for a forgotten script that responds | scanning | 64 |
Busiest networks
| Network | Organisation | Type | Addresses | Blocked now | Requests | Share |
|---|---|---|---|---|---|---|
| AS396982 | Google LLC | cloud | 387 | 36 | 5,248 | |
| AS48090 | Techoff Srv Limited | hosting | 31 | 28 | 2,458 | |
| AS218785 | Tc Datacenter Limited | hosting | 15 | 13 | 694 | |
| AS14956 | RouterHosting LLC | hosting | 6 | 3 | 270 | |
| AS8075 | Microsoft Corporation | cloud | 11 | 0 | 121 | |
| AS14061 | DigitalOcean, LLC | hosting | 38 | 2 | 97 | |
| AS14618 | Amazon.com, Inc. | cloud | 5 | 1 | 81 | |
| AS142430 | DIGI VPS | hosting | 1 | 1 | 38 | |
| AS203861 | Miteflux Technologies Ltd | home broadband | 1 | 0 | 37 | |
| AS211590 | Bucklog SARL | hosting | 2 | 2 | 32 |
Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.
Against the week before
| Measure | Week 37 of 2026 | Week 38 of 2026 | Change |
|---|---|---|---|
| Attack-shaped requests | 5,167 | 9,386 | +4,219 (+82%) |
| Addresses | 362 | 602 | +240 (+66%) |
| Sites reached | 35 | 36 | +1 (+3%) |
| Newly blocked | 0 | 0 | none |