Threat Intelligence Briefing

Global threat activity surged by +107.8% compared to the prior 6-hour period, a significant deviation from the 7-day average. The spike is driven primarily by reconnaissance (118k events) and low-reputation traffic (102k), with notable contributions from malware infrastructure (47k). Romanian and Bulgarian IPs, particularly from ASNs linked to Unmanaged Ltd and TechOff Srv Limited, show coordinated brute-force and SSH attack patterns. Nordic exposure remains proportionally low but aligns with broader trends—Sweden and Finland report elevated brute-force and web attacks. This volume and clustering suggest campaign-driven activity, not background noise. Consider temporary blocking or rate-limiting the /24 ranges associated with <a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a> (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/195.178.110.30" target="_blank">195.178.110.30</a> (<a href="https://ip.wayscloud.services/country-intelligence/BG" target="_blank">BG</a>), both tied to persistent attacker infrastructure. Focus on ASN-level patterns over individual IPs, especially within Datacenter/Hosting environments showing repeated abuse. Deprioritize isolated residential IP reports—these remain consistent with routine scanning behavior and lack campaign coordination.