Threat Intelligence Briefing

Global threat activity decreased by 20.3% compared to the previous 6-hour period, consistent with typical weekday patterns. SSH brute-force attacks remain dominant, accounting for 38% of all threats, primarily originating from NL, GB, and CA. Nordic countries show minimal deviations, with Sweden recording 8 events (5 unique IPs) across attacks and botnets, while Norway and Finland remain at baseline levels. The Russian IP <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a> emerged as the most active threat source, conducting 14 brute-force attacks. Consider temporary rate-limiting for SSH traffic from NL ASNs, particularly targeting the /24 ranges hosting <a href="https://ip.wayscloud.services/ip-intelligence/188.166.107.168" target="_blank">188.166.107.168</a> and <a href="https://ip.wayscloud.services/ip-intelligence/167.99.220.152" target="_blank">167.99.220.152</a>. Deprioritize individual IP blocking for low-volume Nordic events, focusing instead on ASN-level patterns.