Threat Intelligence Briefing

Global threat activity decreased by 2.6% compared to the previous 6-hour period, remaining consistent with the 7-day average. SSH brute force attacks dominated, with notable activity from IPs in NL, BG, and RU. Nordic countries showed stable patterns, with Sweden (12 events) and Norway (10 events) experiencing routine botnet and web attack traffic. The top attacking IPs (e.g., <a href="https://ip.wayscloud.services/ip-intelligence/142.93.224.95" target="_blank">142.93.224.95</a>) have been active for weeks, indicating persistent rather than emerging threats. Consider temporary rate-limiting for SSH traffic from ASNs associated with the top attacking IPs, particularly from NL and RU. Deprioritize individual IP blocking unless part of larger clusters, as these are likely ephemeral.