Threat Intelligence Briefing

Global threat activity decreased sharply by 85.6% compared to the previous period, with 2,610 events observed. This decline is unusual given the typically high baseline, suggesting a potential lull in coordinated campaigns. France (432), Canada (335), and the US (243) remain top sources, while Nordic countries show minimal activity (Finland: 5 events, Sweden: 3). SSH brute-force attacks dominate, with Russian IP <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a> (15 attacks) and Bulgarian <a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a> (10 attacks) as persistent threats. The data indicates a shift from distributed attacks to fewer, more concentrated sources. Consider temporarily blocking /24 ranges associated with high-volume SSH brute-force clusters, particularly from ASNs in Russia and Bulgaria. Prioritize monitoring these CIDRs over isolated IPs, as they exhibit sustained malicious patterns. Deprioritize low-volume spam events, which remain within expected noise levels.