37,288 attack reports in one weekend: May 23–24, 2026
On the weekend of May 23–24, 2026, the ReportedIP network logged 37,288 attack reports from 15,066 unique IP addresses. The figures show what an ordinary weekend of background attacks looks like for any server that is reachable from the internet, including every public WordPress site.
All numbers below are a snapshot of those 48 hours (Berlin time), counted from the report database on September 29, 2026.
How many attacks did the network record on May 23–24, 2026?
Each attack report is one entry sent by a honeypot or a member site when it detects an attacker. Saturday and Sunday produced almost the same volume:
| Day | Attack reports | Unique IPs |
|---|---|---|
| Saturday, May 23 | 18,908 | 8,468 |
| Sunday, May 24 | 18,380 | 9,131 |
| Weekend total | 37,288 | 15,066 |
The weekend total counts each IP address once, so it is lower than the sum of the two days. The weekend was no spike. From Monday, May 18 to Friday, May 22 the network averaged 20,616 reports per day, more than on either weekend day. Attack traffic does not slow down when the office is closed.
Which attack categories dominated the weekend?
Every report carries one or more of the 63 threat categories. A report can carry several categories, so the rows below overlap:
| Category | Reports |
|---|---|
| Hacking | 23,019 |
| Brute-Force | 10,215 |
| SSH | 2,638 |
| WordPress categories combined | 1,255 |
| WordPress login brute force | 1,174 |
Password guessing is the common thread. MITRE catalogues it as technique T1110, and it covers SSH, mail and WordPress logins alike. Over the weekend the average attacker IP appeared in 1.18 categories, and 20 different categories showed up in total. Most addresses stuck to one job.
Where did the attack reports come from?
27,210 reports came from ReportedIP honeypot servers, decoy machines that exist only to be attacked. The remaining 10,078 arrived through the API keys of member sites and server integrations. If you want to add a sensor of your own, the honeypot server guide explains the setup.
By origin country, four countries stood out. The country data comes from the current geolocation of each address:
- United States: 10,984 reports from 3,922 IPs.
- India: 3,038 reports from 2,414 IPs.
- Pakistan: 2,281 reports from 499 IPs.
- Netherlands: 2,009 reports from 320 IPs.
The Netherlands averaged 6.3 reports per IP address and Pakistan 4.6, against 2.5 across the whole weekend. A small group of addresses in those two countries kept coming back. Blocking whole countries is a blunt tool, and blocking the addresses that return is more precise.
What does a weekend like this mean for a WordPress site?
Only 1,255 of the 37,288 reports named a WordPress-specific category. The rest came from bots that probe any open service, and a WordPress site sits on the same internet. Those bots reach the login page sooner or later, and most of them have already been reported somewhere else.
That is where community threat intelligence helps. Once an address has been reported by a honeypot or another site, a site running Hive in Community Network mode can refuse it before the first password attempt. When many addresses attack in parallel, Hardening Mode tightens the login thresholds for an hour.
What changed in Hive around that weekend?
Three Hive releases fell into the same week:
- Hive 2.0.14 (May 20): the list of decoy paths grew from 16 to 40 entries. A request for one of these bait files is a strong attacker signal. Hive 2.1.67 ships 45.
- Hive 2.0.15 (May 21): admin alerts with several recipients are now delivered through the managed mail relay, one mail per address.
- Hive 2.0.16 (May 27): Hardening Mode no longer switches itself back on after it has expired, and a relay backoff now pauses mail and SMS sending for the whole site.
Frequently asked questions
How many attacks did ReportedIP record on May 23–24, 2026?
The ReportedIP network recorded 37,288 attack reports from 15,066 unique IP addresses over the weekend of May 23–24, 2026. Saturday brought 18,908 reports and Sunday 18,380. Honeypot servers sent 27,210 of them, and member sites and server integrations sent the other 10,078 through their API keys.
Were most of the weekend attacks aimed at WordPress?
Most of them were generic. Only 1,255 of the 37,288 reports named a WordPress-specific category, and 1,174 of those were login brute force. The largest groups were Hacking with 23,019 reports and Brute-Force with 10,215. The same bots scan every reachable service, so WordPress sites still receive their share.
Does Hive block reported attackers for free?
Hive blocks reported attackers for free once a site switches to Community Network mode with a free ReportedIP account. All 16 detection sensors and the TOTP, passkey and email 2FA methods are free as well. Hardening Mode against coordinated attacks, SMS 2FA and the managed relays need the Professional plan.
Read on
- Get Hive for WordPress: 16 sensors, four 2FA methods and community blocking in one plugin.
- WordPress Attack Report: attack data from May 1 to July 21, 2026, this weekend included.
- All threat categories: the 63 categories with their severity levels.