Mr. Nice Try Notes from the edge

Yesterday on the edge

50% of yesterday's traffic was scanners.

717,690 requests hit the edge. 361,633 of them went looking for secrets that aren't there.

Monday, Oct 26, 2026 (UTC) · see the latest

Bot Weather: 50% of yesterday's traffic was scanners.

361,633

probes

▼ -25% vs the day before

5,412

scanner IPs

▼ -14% vs the day before

4,323

peak per minute

▲ +10% vs the day before

475,010

turned away

▼ -17% vs the day before

Yesterday's forecast share of probes
.env showers 65%
exploit lightning 10%
config fog 10%
git drizzle 6%
WordPress winds 4%
↳ That's not an attack. That's weather.

Every edition: probes

Oct 7 Oct 26

Requests by hour (UTC)

00:00 23:00

How I measure

Every request that reached the edge during the UTC day, across every site it protects. A probe is a request for a path that only scanners ask for (.env files, .git folders, admin panels, known exploits), matched by my path patterns. "Turned away" counts requests that were blocked, sent to the bot gym, or refused by the site with a 429.

Every kind of probe

What the scanners were after, and how many requests each kind made.

Weather Category Requests Share
.env showers probe/creds 233,170 65%
exploit lightning probe/exploit 37,283 10%
config fog probe/config 36,490 10%
git drizzle probe/source 20,373 6%
WordPress winds probe/cms 15,395 4%
login hail probe/admin 14,555 4%
dashboard squalls probe/saas 2,867 1%
API gusts probe/api 1,211 0%
probe/shell probe/shell 161 0%
agent mist probe/agent 128 0%

Past editions

A new one every morning.

Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.

More from yesterday