Traffic to jon.rehagen.net rose 2.4 percent week over week. In April, after the February strikes on Iran, I measured 251 percent and wrote an article about it. Same site, bigger conflict, better instrument, no spike.
The escalation was real. On August 30 US forces struck Iranian launchers on Larak Island in the Strait of Hormuz. The IRGC answered that night with missiles and drones at US bases in Jordan. CENTCOM ran a further wave against IRGC air defense, radar, and mine-laying targets on September 1. Three days, two directions, a lot of coverage.
My edge did not notice.
Here is the part I did not have in April. That article ended with a line about a Cloudflare-to-BigQuery pipeline I should have built six months earlier. I built it. The site now retains 132 days of hourly edge aggregates and a rolling 30-day honeypot window, all of it published at /explore. In April I had six days of dashboard export and no idea what a normal week looked like. Now I do. The strike week looks like a normal week.
Requests are within the trend set before the strikes; the 18 percent lift over the three-week baseline is the Canadian ramp described below. The firewall-event share of traffic, every request the edge blocked, challenged or flagged, actually fell from about 20 percent across the prior three weeks to under 17 percent during the strikes. The busiest single hour of the strike week is lower than the busiest hour I recorded in April. Honeypot trap hits per day fell against both the prior week and the three-week baseline.
The geography is the flattest result of all. April's story was a cluster of Gulf, Levant, North African, South Asian and Caspian countries sending hundreds of requests each and rendering zero pages. This time, twenty-five conflict-adjacent countries combined sent 99 requests out of 45,134. That is two tenths of one percent, and it is the same two tenths they sent the week before the strikes. Iran itself appears once.
Now the uncomfortable part.
The single largest mover in the strike week is one country that took 55 percent of all traffic, up four and a half times over baseline. It is Canada. Not a proxy-geography story, not a conflict story, just automated volume from one non-adversary geography that arrived, sat on the site for a week, and dominated every chart I have. If I had pulled a seven-day export on September 1 and squinted, I would have written that a war caused a 4.5x traffic surge.
The daily series says otherwise. The Canadian ramp begins on August 21, nine days before the first strike, and it is already the biggest single source by August 25. Whatever it is, it started before the war restarted. I have not looked up who runs it and I would not publish it if I did.
That is the finding, and it is a finding about April, not about August. A number without a baseline is a story you tell yourself. The 251 percent was real arithmetic against a real prior week. It was also six days long, read off a dashboard export, in a window I picked because I had already noticed something. I stand by the mechanism I described in that piece: indiscriminate reconnaissance reaches everything. I am less sure than I was that my site measured it.
One thing did move, and I want to be careful about it.
On August 31, the day after Larak Island, the honeypot logged 96 distinct sources across 36 countries. The 27-day average is 28 sources across 13 countries, and the previous high was 53 and 17. Volume that day was ordinary. Thirteen of those countries had never appeared in the window at all, most contributing exactly one request from exactly one source. Iran and Iraq are each in that list once.
A one-day burst of breadth with no depth, and no follow-on in the four days of the window that came after it, is also the normal signature of a commercial internet-wide scan. One day cannot tell the difference. Observed, not proven, and I am logging it rather than concluding it.
A footnote. I checked the two WordPress form-upload vulnerabilities disclosed in August, CVE-2026-32475 in Elementor Pro and CVE-2026-15748 in Forminator. No request matching either exploit path appears in the strike week, and Forminator appears nowhere in the retention window. What does show up, relentlessly, is the generic upload-shell sweep that predates both, plus the usual /wp-login.php and /xmlrpc.php on a site that has never run WordPress. The scanners are not reading the advisories. They are reading a list from 2014.
The pipeline arrived and the spike did not. That is a worse headline and a better week of data.
The comparison
All windows are UTC. W0 is August 27 to September 2. The baseline is the three weeks from August 6 to August 26. April figures are from Article 23's six-day window, measured with a different instrument, and are shown for shape rather than for arithmetic.
| Measure | April 2026 (Art. 23) | Baseline (3wk) | W-1 Aug 20-26 | W0 Aug 27-Sep 2 |
|---|---|---|---|---|
| Total edge requests | 22,525 (6 days) | 114,992 | 44,065 | 45,134 |
| Requests per day | 3,754 | 5,476 | 6,295 | 6,448 |
| Week-over-week change | +251% | n/a | +16% | +2.4% |
| Firewall events per day | not available | 1,091 | 1,302 | 1,072 |
| Firewall-event share of requests | not available | 19.9% | 20.7% | 16.6% |
| Busiest single hour | 1,517 | n/a | n/a | 1,310 |
| Conflict-adjacent share | roughly 8% | 0.13% | 0.20% | 0.22% |
| Honeypot events per day | not instrumented | 1,509 | 2,016 | 1,747 |
| Honeypot trap hits per day | not instrumented | 251 | 366 | 228 |
| Distinct trap paths | not instrumented | ~319/wk | n/a | 327 |
A four-week baseline agrees with the three-week baseline to within three percent on requests per day, so the comparison is not an artifact of where I cut the window.
Two caveats. First, requests per rendered visit is not comparable between the two articles. April read a Cloudflare dashboard CSV; this reads every hourly aggregate row the edge produced. The instrument changed, so the ratio changed, and anyone publishing that as a trend line is publishing an artifact. Second, human traffic roughly doubled against the baseline week, 587 pageviews against 298, on a smooth daily ramp from the low thirties to 110. The ramp started in mid-August with no step at any strike date, so it does not look like the war. What it does look like, this data cannot say. I published twice in July and twice in August, so my own output did not obviously change either.
What I would tell April me
Instrument first, then wait. A baseline cannot be reconstructed after the event, because the only data that would establish it is the data you did not keep. Every operator who reported a percentage during a news cycle this year had the same problem I did, and many of them will never find out.