Threat Intelligence Briefing

Global threat activity increased by 4.6% compared to the previous 6-hour period, consistent with the 7-day average trend and within normal fluctuation range. Reconnaissance remains dominant (93% of all threats), primarily from known IP clusters in the US, China, and Germany. Nordic countries show stable patterns: Sweden and Finland report expected levels of brute-force and SSH attacks, while Norway and Denmark remain low-volume, focused on reconnaissance. No new campaigns detected; all top IPs have been active for over two weeks, indicating sustained but non-escalating operations. The Netherlands hosts multiple IPs from the same /24 block (91.92.40.0/24) linked to SSH brute-forcing, suggesting infrastructure re-use. Consider temporary blocking or rate-limiting the 91.92.40.0/24 and 45.148.10.0/24 ranges due to recurring malicious activity. Deprioritize individual IP blocking from residential ISPs like Techoff Srv Limited, as their low report-to-IP ratio suggests compromised endpoints rather than dedicated attack infrastructure. Focus monitoring on datacenter ASNs with high report density, particularly DigitalOcean and Unmanaged Ltd, where attack efficiency is higher. No urgent action required—activity reflects routine background noise.