Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (3,545 → 25,529 events), with attacks and spam dominating. The US, Germany, and Netherlands remain top sources, but Russia and China show persistent activity. Nordic countries exhibit stable patterns, with Norway (93 events) and Sweden (72 events) seeing routine attack volumes. SSH brute force and web attacks from NL/RU IPs (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>, <a href="https://ip.wayscloud.services/ip-intelligence/161.35.89.222" target="_blank">161.35.89.222</a>) are notable but consistent with recent campaigns. Consider temporary rate-limiting for CIDR ranges associated with SSH brute force clusters (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/45.148.10.240" target="_blank">45.148.10.240</a>/24). Deprioritize individual IPs from anonymizer services in Sweden/Finland unless correlated with other IOCs.