Threat Intelligence Briefing

Global threat activity decreased by 23.2% compared to the previous 6-hour period, consistent with typical weekend patterns. SSH brute-force attacks remain the dominant category, primarily originating from NL, US, and RU ASNs. Nordic activity remains low, with Sweden (7 events) and Norway (4 events) showing routine web and SSH attack patterns. The Russian IP <a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a> stands out with 16 attacks, but this aligns with known brute-force campaigns active since December 2025. Consider temporary rate-limiting for CIDR ranges associated with Dutch and Russian hosting providers (<a href="https://ip.wayscloud.services/asn-intelligence/20473" target="_blank">AS20473</a>, <a href="https://ip.wayscloud.services/asn-intelligence/49505" target="_blank">AS49505</a>) exhibiting concentrated SSH attack patterns. Deprioritize individual IP responses unless clustered with 5+ events, as 70% of threats came from single-use IPs.