Threat Intelligence Briefing

The global threat landscape showed a marginal 0.5% increase over the past 6 hours, with 871,084 total threats from 435,375 unique IPs across 210 countries. Suspicious activity dominated (72.8% of threats), followed by severe abuse (19.6%). Nordic countries exhibited focused activity, with Sweden leading at 5,487 threats (high_threat and web_brute_force prominent), Finland at 2,436, Norway at 1,198 (high_threat focus), Denmark at 1,087 (SSH brute force notable), and Iceland at 221 threats. The US (162,389) and China (144,347) remained top source countries globally, while the Netherlands (42,819) showed elevated SSH brute force activity. Four Dutch IPs (<a href="https://ip.wayscloud.services/ip-intelligence/167.99.42.56" target="_blank">167.99.42.56</a>, <a href="https://ip.wayscloud.services/ip-intelligence/165.232.92.145" target="_blank">165.232.92.145</a>, <a href="https://ip.wayscloud.services/ip-intelligence/134.122.60.167" target="_blank">134.122.60.167</a>) and one Russian IP (<a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>) were particularly active in SSH brute force attacks, indicating coordinated targeting of Nordic infrastructure. Network defenders should prioritize blocking these IPs and enhance SSH authentication monitoring, especially in Denmark where SSH attacks were prevalent. The absence of Tor exits suggests these are direct attacks from compromised infrastructure.