Week 39 of 2026
The Watchtower from 21 Sep to 27 Sep 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works
← Week 38 of 2026 · All weeks · Week 40 of 2026 → · Atom feed
- Attack-shaped requests
- 7,632−1,754 (−19%) on the week before
- Addresses
- 549−53 (−9%) on the week before
- Networks
- 72
- Sites reached
- 36same as the week before
- Newly blocked
- 0same as the week before
- Busiest hour (UTC)
- 185 requests
In short
In the week of 21 Sep to 27 Sep 2026 the sensors recorded 7,632 attack-shaped requests from 549 addresses on 72 networks.
They reached 36 sites.
The busiest day was Sunday 27 Sep with 1,627 requests; the quietest, Saturday 26 Sep, had 593.
The busiest single hour began at UTC: 185 requests.
By kind: unclassified 56%, hunting for secrets 30%, password spraying 8%.
The single most common request shape, 3,944 times: an address made a request that matched no known pattern.
By sensor: edge 100%.
The busiest network was AS396982 (Google LLC, cloud): 3,766 requests from 325 addresses, 86 of them blocked now.
No new address was blocked on our servers that week.
Against the week before: requests 9,386 to 7,632 (-19%), addresses 602 to 549 (-9%), new blocks unchanged at 0.
Commentary
Against the week before, requests fell from 9,386 to 7,632, a drop of 19 percent, and addresses fell from 602 to 549, down 9 percent. Sites reached held steady at 36 and no new address was blocked on our servers either week. Of this week's traffic, 307 requests were blocked at the edge without matching any specific attack signature.
By day
| Day | Requests | Share |
|---|---|---|
| Monday | 1,003 | |
| Tuesday | 1,066 | |
| Wednesday | 1,063 | |
| Thursday | 1,247 | |
| Friday | 1,033 | |
| Saturday | 593 | |
| Sunday | 1,627 |
What they tried
By kind
| Attack type | Requests | Share |
|---|---|---|
| unclassified | 4,251 | |
| hunting for secrets | 2,320 | |
| password spraying | 608 | |
| scanning | 372 | |
| fake crawlers | 49 | |
| injection | 28 | |
| scanning tools | 4 |
By sensor
| Sensor | Requests | Share |
|---|---|---|
| edge | 7,632 |
Most common request shapes
| Kind of request | Attack type | Requests | Share |
|---|---|---|---|
| Made a request that matched no known pattern | unclassified | 3,944 | |
| Requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | hunting for secrets | 2,231 | |
| Requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods | password spraying | 608 | |
| Was blocked at the edge without matching any specific attack signature | unclassified | 307 | |
| Enumerated WordPress REST API post IDs, a common precursor to username/content fingerprinting | scanning | 191 | |
| Probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | scanning | 155 | |
| Requested a .env file, hoping to find API keys or database credentials | hunting for secrets | 71 | |
| Claimed to be Googlebot while POSTing, something the real crawler never does | fake crawlers | 49 | |
| Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root | injection | 28 | |
| Probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface | scanning | 26 |
Busiest networks
| Network | Organisation | Type | Addresses | Blocked now | Requests | Share |
|---|---|---|---|---|---|---|
| AS396982 | Google LLC | cloud | 325 | 86 | 3,766 | |
| AS48090 | Techoff Srv Limited | hosting | 38 | 37 | 2,282 | |
| AS218785 | Tc Datacenter Limited | hosting | 12 | 11 | 172 | |
| AS139490 | Aspt Networks Pvt Ltd | home broadband | 1 | 0 | 150 | |
| AS203020 | HostRoyale Technologies Pvt Ltd | hosting | 1 | 0 | 150 | |
| AS9299 | Philippine Long Distance Telephone Company | home broadband | 1 | 0 | 149 | |
| AS24560 | Bharti Airtel Ltd., Telemedia Services | internet provider | 1 | 0 | 149 | |
| AS14956 | RouterHosting LLC | hosting | 5 | 3 | 105 | |
| AS14061 | DigitalOcean, LLC | hosting | 39 | 3 | 84 | |
| AS203861 | Miteflux Technologies Ltd | home broadband | 3 | 1 | 72 |
Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.
Against the week before
| Measure | Week 38 of 2026 | Week 39 of 2026 | Change |
|---|---|---|---|
| Attack-shaped requests | 9,386 | 7,632 | −1,754 (−19%) |
| Addresses | 602 | 549 | −53 (−9%) |
| Sites reached | 36 | 36 | none |
| Newly blocked | 0 | 0 | none |