Week 45 of 2026

The Watchtower from 2 Nov to 8 Nov 2026, in numbers: what our sensors recorded, where it came from and what changed on the block list. How the board works

Week 44 of 2026 · All weeks · Atom feed

Attack-shaped requests: 306,962−14,488 (−5%) on the week before
Addresses: 4,670+267 (+6%) on the week before
Networks: 942
Sites reached: 37−3 (−8%) on the week before
Newly blocked: 2,054+139 (+7%) on the week before
Busiest hour (UTC): 5 Nov 21:0020,016 requests

In short

In the week of 2 Nov to 8 Nov 2026 the sensors recorded 306,962 attack-shaped requests from 4,670 addresses on 942 networks.

They reached 37 sites.

The busiest day was Thursday 5 Nov with 74,083 requests; the quietest, Saturday 7 Nov, had 24,705.

The busiest single hour began at 5 Nov 2026 21:00 UTC: 20,016 requests.

By kind: scanning 41%, hunting for secrets 28%, password guessing 20%.

The single most common request shape, 61,570 times: an address requested a .env file, hoping to find API keys or database credentials.

By sensor: honeypot 43%, web 43%, edge 14%, mail 1%, the rest under 1%.

The busiest network was AS48090 (Techoff Srv Limited, hosting): 83,157 requests from 62 addresses, 62 of them blocked now.

2,054 addresses were newly blocked on our servers: 970 on home broadband networks, 719 on cloud networks, 332 on hosting networks, 21 on mobile networks, 12 on internet provider networks. 2,054 of them stay on the list with no end date.

Against the week before: requests 321,450 to 306,962 (-5%), addresses 4,403 to 4,670 (+6%), new blocks 1,915 to 2,054 (+7%).

Commentary

From 2 Nov to 8 Nov 2026 the sensors recorded 306,962 requests from 4,670 addresses on 942 networks. They reached 37 sites. Requests fell from 321,450 the week before, while the number of addresses rose from 4,403 to 4,670.

Thursday 5 Nov was the busiest day with 74,083 requests. The busiest hour began at 2026-11-05T21:00:00Z and held 20,016 requests. Saturday 7 Nov was the quietest, with 24,705. Scanning made up the largest share at 124,572 requests, then hunting for secrets at 86,461 and password guessing at 62,052. The most common single request, 61,570 times, asked for a .env file.

The busiest network was AS48090, Techoff Srv Limited, a hosting network. It sent 83,157 requests from 62 addresses, and all 62 are blocked now. We added 2,054 new blocks, up from 1,915 the week before. None of them has an end date.

By day

Attack-shaped requests per day, 2 Nov to 8 Nov 2026 (UTC)
Day	Requests	Share
Monday 2 Nov	40,274
Tuesday 3 Nov	36,173
Wednesday 4 Nov	40,235
Thursday 5 Nov	74,083
Friday 6 Nov	57,173
Saturday 7 Nov	24,705
Sunday 8 Nov	34,319

What they tried

By kind

Attack-shaped requests by attack type
Attack type	Requests	Share
scanning	124,572
hunting for secrets	86,461
password guessing	62,052
known exploits	26,569
injection	3,822
scanning tools	1,436
password spraying	649
unclassified	488
leaked-password reuse	452
mail relay probing	417
fake crawlers	39
open proxy probing	3
flooding	2

By sensor

Attack-shaped requests by sensor
Sensor	Requests	Share
honeypot	131,779
web	131,565
edge	41,731
mail	1,755
named	68
ssh	64

Most common request shapes

The ten most common request shapes
Kind of request	Attack type	Requests
Requested a .env file, hoping to find API keys or database credentials	hunting for secrets	61,570
Typed a command into a decoy shell that is not connected to anything real	scanning	58,763
Tried a username and password on a decoy remote login that never lets anyone in	password guessing	58,371
Probed a list of common site paths looking for an unprotected admin panel or staging copy	scanning	30,224
Triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt	known exploits	26,284
Fuzzed a short, random filename looking for a forgotten script that responds	scanning	10,127
Requested a decoy path that only a scanner would ask for	scanning	7,841
Requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot	hunting for secrets	6,546
Probed a WordPress admin/content path used to fingerprint the installation or hunt for an exposed upload/plugin surface	scanning	5,607
Used a directory-traversal segment (literal or percent-encoded ../) in the request path to try to escape the web root	injection	3,518

Busiest networks

The ten networks with the most attack-shaped requests
Network	Organisation	Type	Addresses	Blocked now	Requests
AS48090	Techoff Srv Limited	hosting	62	62	83,157
AS396982	Google LLC	cloud	528	449	65,127
AS198364	Banatsync Srl	home broadband	32	32	41,314
AS5410	Bouygues Telecom SA	home broadband	3	1	35,547
AS47890	Unmanaged Ltd	home broadband	29	28	23,383
AS8075	Microsoft Corporation	cloud	214	85	8,045
AS218785	Tc Datacenter Limited	hosting	29	29	7,034
AS211590	Bucklog SARL	hosting	12	11	5,481
AS14061	DigitalOcean, LLC	hosting	310	197	3,209
AS53667	FranTech Solutions	home broadband	4	4	2,120

Blocked now: of the addresses seen that week on the network, how many are blocked on our servers today.

Block list

New blocks by network type

Addresses newly blocked that week, by network type
Network type	Addresses	Share
home broadband	970
cloud	719
hosting	332
mobile network	21
internet provider	12

How they got there

New blocks: 2,054
No end date: 2,054every block

Against the week before

This week against Week 44 of 2026
Measure	Week 44 of 2026	Week 45 of 2026	Change
Attack-shaped requests	321,450	306,962	−14,488 (−5%)
Addresses	4,403	4,670	+267 (+6%)
Sites reached	40	37	−3 (−8%)
Newly blocked	1,915	2,054	+139 (+7%)

Week 44 of 2026 in full