Threat Intelligence Briefing

Global threat activity changed by several orders of magnitude (2,231 → 17,637 events), with spam (4,120), attacks (3,816), and malware C2 (3,098) dominating. The Netherlands (3,227), US (2,773), and China (1,134) were top sources. Nordic activity remained stable, with Finland (48 events) and Sweden (36) showing routine scanning and brute-force attempts. The surge is linked to a known botnet cluster (ASNs in NL/RU), not new infrastructure. This is a significant deviation from the 7-day average, indicating coordinated activity rather than background noise. Consider temporary blocking of /16 CIDR ranges associated with Dutch and Russian ASNs showing SSH brute-force patterns (<a href="https://ip.wayscloud.services/ip-intelligence/204.76.203.0" target="_blank">204.76.203.0</a>/24, <a href="https://ip.wayscloud.services/ip-intelligence/176.120.22.0" target="_blank">176.120.22.0</a>/24). Deprioritize individual IPs from these ranges unless they exceed 10 events/hour, as the cluster behavior is the primary threat.