Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (1,537 → 17,010 events), with spam and attacks dominating. The US, Netherlands, and China remain top sources, but Russia and Pakistan show increased SSH brute-force activity. Nordic countries exhibit stable patterns, except Iceland where botnet C2 activity (<a href="https://ip.wayscloud.services/ip-intelligence/82.221.139.173" target="_blank">82.221.139.173</a>) persists for over 48 hours. This deviation suggests a coordinated campaign rather than routine noise. Consider temporary blocking of /24 CIDRs from ASNs linked to SSH brute-force clusters in Russia and the Netherlands, particularly targeting port 22. Deprioritize individual IPs from spam sources, as these rotate frequently and lack persistence.