Week 43 of 2026

The Watchtower from 19 Oct to 25 Oct 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works

Week 42 of 2026 · All weeks · Atom feed

Attack-shaped requests: 269,474+78,589 (+41%) on the week before
Addresses: 6,696+2,887 (+76%) on the week before
Networks: 1,211
Sites reached: 36+2 (+6%) on the week before
Newly blocked: 3,012−1,459 (−33%) on the week before
Busiest hour (UTC): 24 Oct 00:005,166 requests

In short

In the week of 19 Oct to 25 Oct 2026 the sensors recorded 269,474 attack-shaped requests from 6,696 addresses on 1,211 networks.

They reached 36 sites.

The busiest day was Friday 23 Oct with 54,814 requests; the quietest, Monday 19 Oct, had 23,554.

The busiest single hour began at 24 Oct 2026 00:00 UTC: 5,166 requests.

By kind: hunting for secrets 44%, scanning 19%, password guessing 18%.

The single most common request shape, 87,913 times: an address requested a .env file, hoping to find API keys or database credentials.

By sensor: web 49%, honeypot 29%, edge 20%, mail 2%, the rest under 1%.

The busiest network was AS396982 (Google LLC, cloud): 131,176 requests from 596 addresses, 566 of them blocked now.

3,012 addresses were newly blocked on our servers: 1,610 on home broadband networks, 756 on cloud networks, 551 on hosting networks, 57 on mobile networks, 38 on internet provider networks. 3,003 of them stay on the list with no end date.

Against the week before: requests 190,885 to 269,474 (+41%), addresses 3,809 to 6,696 (+76%), new blocks 4,471 to 3,012 (-33%).

Commentary

For the week of 19 Oct to 25 Oct 2026 the sensors recorded 269,474 attack-shaped requests from 6,696 addresses on 1,211 networks. They reached 36 sites. A week earlier it was 190,885 requests from 3,809 addresses, so requests rose 41% and addresses rose 76%.

Friday 23 Oct was the busiest day with 54,814 requests. Monday 19 Oct was the quietest with 23,554. The busiest single hour began at 2026-10-24T00:00:00Z and saw 5,166 requests. The busiest network was AS396982, the network of Google LLC, a cloud network: 131,176 requests from 596 addresses, 566 of them blocked now. Next came Banatsync Srl, a home broadband network, with 41,518 requests from 31 addresses, all 31 blocked. Hunting for secrets made up 117,462 requests, and 87,913 of those asked for a .env file. We added 3,012 new blocks, down from 4,471 the week before. 3,003 of them stay on the list with no end date.

By day

Attack-shaped requests per day, 19 Oct to 25 Oct 2026 (UTC)
Day	Requests	Share
Monday 19 Oct	23,554
Tuesday 20 Oct	36,778
Wednesday 21 Oct	27,518
Thursday 22 Oct	31,098
Friday 23 Oct	54,814
Saturday 24 Oct	51,687
Sunday 25 Oct	44,025

What they tried

By kind

Attack-shaped requests by attack type
Attack type	Requests	Share
hunting for secrets	117,462
scanning	52,211
password guessing	49,355
password spraying	24,226
injection	15,053
known exploits	4,594
leaked-password reuse	2,762
scanning tools	2,682
unclassified	562
fake crawlers	350
mail relay probing	159
flooding	49
open proxy probing	9

By sensor

Attack-shaped requests by sensor
Sensor	Requests	Share
web	132,661
honeypot	77,110
edge	53,640
mail	5,882
named	105
ssh	76

Most common request shapes

The ten most common request shapes
Kind of request	Attack type	Requests
Requested a .env file, hoping to find API keys or database credentials	hunting for secrets	87,913
Tried a username and password on a decoy remote login that never lets anyone in	password guessing	41,845
Requested xmlrpc.php, which exposes a multicall method commonly abused to spray WordPress credentials and relay pingback floods	password spraying	23,978
Typed a command into a decoy shell that is not connected to anything real	scanning	21,149
Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root	injection	14,650
Requested a decoy path that only a scanner would ask for	scanning	9,292
Requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot	hunting for secrets	8,803
Attempted to authenticate to the mail server with a wrong password	password guessing	4,962
Swept a generic login/signup/account/dashboard route this site does not expose, consistent with an automated app-framework scanner	scanning	4,575
Triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt	known exploits	3,977

Busiest networks

The ten networks with the most attack-shaped requests
Network	Organisation	Type	Addresses	Blocked now	Requests
AS396982	Google LLC	cloud	596	566	131,176
AS198364	Banatsync Srl	home broadband	31	31	41,518
AS48090	Techoff Srv Limited	hosting	64	64	9,350
AS47890	Unmanaged Ltd	home broadband	27	26	9,121
AS14061	DigitalOcean, LLC	hosting	349	252	4,197
AS211590	Bucklog SARL	hosting	13	13	4,113
AS31898	Oracle Corporation	cloud	68	55	3,946
AS218785	Tc Datacenter Limited	hosting	27	26	3,089
AS24560	Bharti Airtel Ltd., Telemedia Services	internet provider	58	26	2,579
AS8075	Microsoft Corporation	cloud	135	64	1,877

Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.

Block list

New blocks by network type

Addresses newly blocked that week, by network type
Network type	Addresses	Share
home broadband	1,610
cloud	756
hosting	551
mobile network	57
internet provider	38

How they got there

New blocks: 3,012
No end date: 3,012every block

Against the week before

This week against Week 42 of 2026
Measure	Week 42 of 2026	Week 43 of 2026	Change
Attack-shaped requests	190,885	269,474	+78,589 (+41%)
Addresses	3,809	6,696	+2,887 (+76%)
Sites reached	34	36	+2 (+6%)
Newly blocked	4,471	3,012	−1,459 (−33%)

Week 42 of 2026 in full