Week 41 of 2026

The Watchtower from 5 Oct to 11 Oct 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works

· All weeks · Atom feed

Attack-shaped requests
242,146+88,492 (+58%) on the week before
Addresses
2,926+714 (+32%) on the week before
Networks
718
Sites reached
35−5 (−13%) on the week before
Newly blocked
342+33 (+11%) on the week before
Busiest hour (UTC)
5,981 requests

In short

In the week of 5 Oct to 11 Oct 2026 the sensors recorded 242,146 attack-shaped requests from 2,926 addresses on 718 networks.

They reached 35 sites.

The busiest day was Tuesday 6 Oct with 43,373 requests; the quietest, Sunday 11 Oct, had 21,856.

The busiest single hour began at UTC: 5,981 requests.

By kind: scanning 48%, hunting for secrets 42%, injection 4%.

The single most common request shape, 85,676 times: an address fuzzed a short, random filename looking for a forgotten script that responds.

By sensor: web 96%, edge 4%, the rest under 1%.

The busiest network was AS8075 (Microsoft Corporation, cloud): 93,551 requests from 142 addresses, 59 of them blocked now.

342 addresses were newly blocked on our servers: 218 on cloud networks, 66 on hosting networks, 54 on home broadband networks, 2 on internet provider networks, 2 on mobile networks. 66 of them stay on the list with no end date. 159 came through the fast-track rule.

Against the week before: requests 153,654 to 242,146 (+58%), addresses 2,212 to 2,926 (+32%), new blocks 309 to 342 (+11%).

Commentary

In the week of 5 Oct to 11 Oct 2026 the sensors recorded 242,146 requests from 2,926 addresses on 718 networks. They reached 35 sites. A week earlier it was 153,654 requests from 2,212 addresses, so requests rose 58% and addresses rose 32%. The sites reached went from 40 to 35.

The busiest day was Tuesday 6 Oct with 43,373 requests, and the busiest hour began at 2026-10-06T15:00:00Z with 5,981. Sunday 11 Oct was the quietest day at 21,856. Scanning made up 115,946 requests and hunting for secrets 102,703. The busiest network was AS8075, Microsoft Corporation, a cloud network: 93,551 requests from 142 addresses, 59 of them blocked now. Google LLC on AS396982 followed with 80,908 requests from 448 addresses. We blocked 342 new addresses, up from 309. Of those, 218 were on cloud networks, 66 on hosting networks and 54 on home broadband. 66 stay on the list with no end date, and 159 came through the fast-track rule. There were no delisting requests.

By day

Attack-shaped requests per day, 5 Oct to 11 Oct 2026 (UTC)
DayRequestsShare
Monday 31,710
Tuesday 43,373
Wednesday 30,533
Thursday 35,031
Friday 40,270
Saturday 39,373
Sunday 21,856

What they tried

By kind

Attack-shaped requests by attack type
Attack typeRequestsShare
scanning115,946
hunting for secrets102,703
injection10,791
password spraying6,825
known exploits3,133
scanning tools1,358
unclassified570
password guessing403
mail relay probing270
fake crawlers130
open proxy probing13
flooding4

By sensor

Attack-shaped requests by sensor
SensorRequestsShare
web231,348
edge9,713
mail864
panel131
ssh87
ftp3

Most common request shapes

The ten most common request shapes
Kind of requestAttack typeRequestsShare
Fuzzed a short, random filename looking for a forgotten script that respondsscanning85,676
Requested a .env file, hoping to find API keys or database credentialshunting for secrets61,420
Requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroothunting for secrets12,073
Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web rootinjection10,291
Probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surfacescanning8,764
Requested a database dump or site archive by its common backup filenamehunting for secrets7,245
Requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floodspassword spraying6,602
Requested a WordPress core file used to fingerprint the installed version and active pluginsscanning4,963
Swept a generic login/signup/account/dashboard route this site does not expose, consistent with an automated app-framework scannerscanning4,884
Probed a list of common site paths looking for an unprotected admin panel or staging copyscanning4,182

Busiest networks

The ten networks with the most attack-shaped requests
NetworkOrganisationTypeAddressesBlocked nowRequestsShare
AS8075Microsoft Corporationcloud1425993,551
AS396982Google LLCcloud44817480,908
AS218785Tc Datacenter Limitedhosting281910,780
AS15169Google LLCcloud31148,740
AS48090Techoff Srv Limitedhosting47418,088
AS211590Bucklog SARLhosting11107,860
AS213438ColocaTel Inc.home broadband314,607
AS14618Amazon.com, Inc.cloud1113,271
AS197170TechTies Inc.hosting28192,270
AS202412Omegatech LTDhosting1751,754

Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.

Block list

New blocks by network type

Addresses newly blocked that week, by network type
Network typeAddressesShare
cloud218
hosting66
home broadband54
internet provider2
mobile network2

How they got there

By score
183
Fast-track rule
159
No end date
66hosting networks
On the public list
171of the newly blocked

Against the week before

This week against Week 40 of 2026
MeasureWeek 40 of 2026Week 41 of 2026Change
Attack-shaped requests153,654242,146+88,492 (+58%)
Addresses2,2122,926+714 (+32%)
Sites reached4035−5 (−13%)
Newly blocked309342+33 (+11%)

Week 40 of 2026 in full