Threat Intelligence Briefing

Global threat activity increased by 0.5% over the past 6 hours, with 877,639 incidents from 438,299 unique IPs. Suspicious activity dominated (72.7% of threats), followed by severe abuse (19.1%). The US (165,007) and China (146,106) remained top sources. In the Nordics, Sweden led with 6,062 threats (50% high/moderate threats), followed by Finland (2,328, including SSH brute force) and Norway (1,195, with Tor exit nodes). Denmark saw 1,105 threats, primarily web attacks, while Iceland reported minimal activity (216 threats). Nordic threats skewed toward infrastructure targeting, unlike global patterns focusing on suspicious traffic. Five IPs (<a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>, <a href="https://ip.wayscloud.services/ip-intelligence/165.232.93.108" target="_blank">165.232.93.108</a>, etc.) from Russia and Netherlands conducted 43 SSH brute-force attacks. These originated from datacenters, suggesting botnet activity. Network defenders should prioritize blocking these IPs and monitor SSH/web login attempts. Nordic ISPs must scrutinize traffic from NL/RU IPs, especially ports 22 and 80.