Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (1,615 → 19,560 events), with spam and malware C2 dominating. The Netherlands (ASN 16276, 43350) and Russia (ASN 49505) show concentrated SSH brute-force attacks, consistent with a 48-hour campaign. Nordic activity remains stable compared to the 7-day average, with Finland and Sweden seeing routine scanning and web attacks. Iceland's low baseline saw 8 events, primarily spam. The spike in Dutch IPs (<a href="https://ip.wayscloud.services/ip-intelligence/178.62.235.249" target="_blank">178.62.235.249</a>, <a href="https://ip.wayscloud.services/ip-intelligence/165.22.202.133" target="_blank">165.22.202.133</a>) suggests a coordinated SSH brute-force campaign rather than isolated incidents. Consider temporary rate-limiting for /24 blocks from ASN 16276 and 43350, given their disproportionate SSH attack volume. Deprioritize individual IPs from Bulgaria (<a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a>) as they represent background noise. No action required for Nordic spam clusters unless volume increases.