Yesterday on the edge
46% of yesterday's traffic was scanners.
765 requests hit the edge. 351 of them went looking for secrets that aren't there.
Wednesday, Oct 7, 2026 (UTC) · see the latest
351
probes
14
scanner IPs
147
peak per minute
30
turned away
Requests by hour (UTC)
How I measure
Every request that reached the edge during the UTC day, across every site it protects. A probe is a request for a path that only scanners ask for (.env files, .git folders, admin panels, known exploits), matched by my path patterns. "Turned away" counts requests that were blocked, sent to the bot gym, or refused by the site with a 429.
Every kind of probe
What the scanners were after, and how many requests each kind made.
| Weather | Category | Requests | Share |
|---|---|---|---|
| .env showers | probe/creds | 193 | 55% |
| exploit lightning | probe/exploit | 61 | 17% |
| config fog | probe/config | 41 | 12% |
| git drizzle | probe/source | 24 | 7% |
| API gusts | probe/api | 16 | 5% |
| login hail | probe/admin | 13 | 4% |
| WordPress winds | probe/cms | 3 | 1% |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Fraud Desk · Oct 8
29,885 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 8
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
The AI Key Heist · Oct 8
Bots went hunting for AI keys 847 times.
Bots are hunting for AI API keys. Here's whose they want most.
Cloud Landlords · Oct 8
89% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 8
New sites get scanned in 171 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 8
95% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.