Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (2,221 → 18,226 events), with spam (4,812 events) and attacks (3,200) dominating. The US, Netherlands, and China remain top sources, consistent with historical patterns. Nordic activity remains stable, with Sweden (76 events) and Finland (44) showing routine scanning and brute-force attempts. No significant deviations from regional baselines were observed. SSH brute-force attacks from Russian (<a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>) and Dutch (<a href="https://ip.wayscloud.services/ip-intelligence/167.172.45.30" target="_blank">167.172.45.30</a>) IPs were notable but not unprecedented. Consider temporary rate-limiting for SSH traffic from ASNs associated with high-volume brute-force patterns, particularly in NL and VN ranges. Deprioritize individual IP blocking unless part of sustained clusters exceeding 10 events within the period.