Threat Intelligence Briefing
Analysis period: 2026-01-21T00:00:02.041557 - 2026-01-21T06:00:02.041557 (6 hours)
Executive Summary
Threat activity changed by several orders of magnitude (2,064 → 16,264 events), marking a significant deviation from the previous period. Attacks (4,165 events) and spam (3,075) dominate, with the US (3,605) and Netherlands (2,831) as top origin countries. Nordic activity remains stable, with Finland (52 events) and Sweden (48) showing routine patterns. Russian IPs <a href="https://ip.wayscloud.services/ip-intelligence/176.120.22.13" target="_blank">176.120.22.13</a>/47 and Bulgarian <a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a> lead SSH brute-force attempts, consistent with known campaigns. Consider temporary blocking of /24 ranges from <a href="https://ip.wayscloud.services/asn-intelligence/48347" target="_blank">AS48347</a> (Russia) and <a href="https://ip.wayscloud.services/asn-intelligence/8866" target="_blank">AS8866</a> (Bulgaria) due to concentrated attack patterns. Deprioritize individual IPs from low-volume countries like Iceland (6 events) unless part of broader clusters.