Week 42 of 2026

The Watchtower from 12 Oct to 18 Oct 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works

Week 41 of 2026 · All weeks · Atom feed

Attack-shaped requests: 190,885−51,261 (−21%) on the week before
Addresses: 3,809+883 (+30%) on the week before
Networks: 858
Sites reached: 34−1 (−3%) on the week before
Newly blocked: 4,471+4,129 (+1,207%) on the week before
Busiest hour (UTC): 15 Oct 20:008,428 requests

In short

In the week of 12 Oct to 18 Oct 2026 the sensors recorded 190,885 attack-shaped requests from 3,809 addresses on 858 networks.

They reached 34 sites.

The busiest day was Wednesday 14 Oct with 37,151 requests; the quietest, Tuesday 13 Oct, had 17,423.

The busiest single hour began at 15 Oct 2026 20:00 UTC: 8,428 requests.

By kind: hunting for secrets 39%, scanning 28%, password guessing 16%.

The single most common request shape, 54,908 times: an address requested a .env file, hoping to find API keys or database credentials.

By sensor: web 63%, honeypot 27%, edge 9%, mail 1%, the rest under 1%.

The busiest network was AS396982 (Google LLC, cloud): 76,492 requests from 495 addresses, 450 of them blocked now.

4,471 addresses were newly blocked on our servers: 1,968 on cloud networks, 1,569 on home broadband networks, 820 on hosting networks, 79 on mobile networks, 35 on internet provider networks. 4,451 of them stay on the list with no end date.

Against the week before: requests 242,146 to 190,885 (-21%), addresses 2,926 to 3,809 (+30%), new blocks 342 to 4,471 (+1,207%).

Commentary

From 12 Oct to 18 Oct 2026 the sensors recorded 190,885 attack-shaped requests from 3,809 addresses on 858 networks. They reached 34 sites. Requests fell by 21% on the week before, when there were 242,146, while the number of addresses rose by 30%, from 2,926 to 3,809.

The busiest day was Wednesday 14 Oct with 37,151 requests. The quietest was Tuesday 13 Oct with 17,423. The busiest single hour began at 2026-10-15T20:00:00Z and held 8,428 requests. Hunting for secrets made up 39% of the traffic, and the most common single request, made 54,908 times, was for a .env file. The busiest network was AS396982, Google LLC, a cloud network: 76,492 requests from 495 addresses, 450 of them blocked now. Microsoft Corporation's cloud network came second with 25,453 requests. On our side, 4,471 addresses were newly blocked, up from 342 the week before. Of those, 4,451 stay on the list with no end date.

By day

Attack-shaped requests per day, 12 Oct to 18 Oct 2026 (UTC)
Day	Requests	Share
Monday 12 Oct	25,273
Tuesday 13 Oct	17,423
Wednesday 14 Oct	37,151
Thursday 15 Oct	32,324
Friday 16 Oct	30,846
Saturday 17 Oct	27,900
Sunday 18 Oct	19,968

What they tried

By kind

Attack-shaped requests by attack type
Attack type	Requests	Share
hunting for secrets	73,944
scanning	53,634
password guessing	31,190
injection	9,904
leaked-password reuse	8,703
password spraying	7,862
known exploits	2,832
scanning tools	1,362
unclassified	796
mail relay probing	323
fake crawlers	281
flooding	49
open proxy probing	5

By sensor

Attack-shaped requests by sensor
Sensor	Requests	Share
web	120,197
honeypot	50,760
edge	17,872
mail	1,891
ssh	81
panel	44
named	39
ftp	1

Most common request shapes

The ten most common request shapes
Kind of request	Attack type	Requests
Requested a .env file, hoping to find API keys or database credentials	hunting for secrets	54,908
Tried a username and password on a decoy remote login that never lets anyone in	password guessing	28,325
Fuzzed a short, random filename looking for a forgotten script that responds	scanning	23,262
Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root	injection	9,186
Requested a decoy path that only a scanner would ask for	scanning	9,031
Submitted credentials to a decoy login form designed to capture, never validate, them	leaked-password reuse	8,703
Requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods	password spraying	7,535
Typed a command into a decoy shell that is not connected to anything real	scanning	6,794
Requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot	hunting for secrets	5,274
Probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface	scanning	3,182

Busiest networks

The ten networks with the most attack-shaped requests
Network	Organisation	Type	Addresses	Blocked now	Requests
AS396982	Google LLC	cloud	495	450	76,492
AS8075	Microsoft Corporation	cloud	134	75	25,453
AS198364	Banatsync Srl	home broadband	38	38	20,951
AS7545	TPG Telecom Limited	home broadband	4	1	9,921
AS211590	Bucklog SARL	hosting	14	13	4,153
AS47890	Unmanaged Ltd	home broadband	20	19	3,417
AS14061	DigitalOcean, LLC	hosting	339	246	3,174
AS15169	Google LLC	cloud	13	13	3,115
AS4134	Chinanet	home broadband	30	6	2,886
AS142271	EWS DS Networks Inc	home broadband	1	1	2,459

Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.

Block list

New blocks by network type

Addresses newly blocked that week, by network type
Network type	Addresses	Share
cloud	1,968
home broadband	1,569
hosting	820
mobile network	79
internet provider	35

How they got there

New blocks: 4,471
No end date: 4,471every block

Against the week before

This week against Week 41 of 2026
Measure	Week 41 of 2026	Week 42 of 2026	Change
Attack-shaped requests	242,146	190,885	−51,261 (−21%)
Addresses	2,926	3,809	+883 (+30%)
Sites reached	35	34	−1 (−3%)
Newly blocked	342	4,471	+4,129 (+1,207%)

Week 41 of 2026 in full