Threat Intelligence Briefing

Global threat activity decreased by 34.9% compared to the previous 6-hour period, with 1,466 events. SSH brute-force and attacks remain dominant, accounting for 39% of all threats. Russian IPs <a href="https://ip.wayscloud.services/ip-intelligence/45.140.17.124" target="_blank">45.140.17.124</a> and <a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a> were the most active, targeting SSH services. Nordic activity was stable, with Sweden recording 8 events (4 unique IPs) and Norway 3 events (1 unique IP), consistent with their 7-day averages. No new campaigns emerged; all observed threats align with routine background noise. Consider temporarily blocking or rate-limiting traffic from ASNs associated with the top Russian and Dutch IPs, particularly for SSH services. Deprioritize individual IP blocking unless they exhibit sustained attack patterns beyond typical noise levels.