Threat Intelligence Briefing

Global threat activity remains stable with a -0.4% change compared to the previous 6-hour period, consistent with the 7-day average. Norway (<a href="https://ip.wayscloud.services/country-intelligence/NO" target="_blank">NO</a>) showed notable activity with 120 threats, primarily attacks and botnet traffic, aligning with its recent baseline. The top attacking countries (NL, US, NO) and categories (attacks, SSH brute force) reflect routine patterns. No new campaigns emerged; all observed threats have been active for weeks. Nordic regions (SE, FI) displayed expected low-volume activity without deviations. The most persistent IPs (<a href="https://ip.wayscloud.services/ip-intelligence/45.135.232.92" target="_blank">45.135.232.92</a>, <a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a>) originate from known high-risk ASNs. Focus on monitoring SSH brute force clusters from NL and RU CIDR ranges, which account for 25% of global attacks. Temporary rate-limiting for these ranges may reduce noise. Deprioritize isolated spikes from low-volume countries (FI, BR) unless sustained.