Threat Intelligence Briefing

Global threat activity increased 0.7% in the past 6 hours, totaling 869,649 incidents. Nordic countries showed varied activity, with Sweden (5,860 threats) leading regional attacks, primarily involving botnet activity, SSH brute force, and web attacks. Finland (2,328) and Norway (1,194) followed, showing similar patterns. Denmark (1,132) and Iceland (216) reported lower volumes but persistent high-threat incidents. Globally, the US (161,931) and China (145,352) remained top sources, while suspicious activity (632,094) dominated threat categories. The Netherlands (41,329) hosted notable attack infrastructure, including IP <a href="https://ip.wayscloud.services/ip-intelligence/164.90.206.5" target="_blank">164.90.206.5</a> targeting SSH services. Key IPs to monitor include Russia's <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a> (14 SSH brute force attacks) and Bulgaria's <a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a> (9 brute force attempts). Nordic networks should prioritize SSH hardening, as 60% of regional attacks targeted this vector. Web application firewalls are recommended for Swedish entities due to increasing web-based threats. All Nordic ISPs should scrutinize traffic from NL-based IPs like <a href="https://ip.wayscloud.services/ip-intelligence/161.35.90.185" target="_blank">161.35.90.185</a>, which combined web attacks with SSH abuse.