Threat Intelligence Briefing

Global threat activity increased significantly, with 274,681 total threats recorded—+86.7% versus the previous 6-hour period. This surge is primarily driven by reconnaissance and low-reputation traffic, now accounting for over 74% of all events. Notably, Romanian IP blocks under <a href="https://ip.wayscloud.services/asn-intelligence/197314" target="_blank">AS197314</a> (Unmanaged Ltd) and <a href="https://ip.wayscloud.services/asn-intelligence/39559" target="_blank">AS39559</a> (Techoff Srv Limited) show coordinated brute-force campaigns targeting SSH services. Nordic countries remain within expected ranges, with Sweden and Finland reporting typical multi-category activity, though no unusual spikes. The increase aligns with broader campaign patterns observed over the past 72 hours, not isolated noise. Consider temporary blocking or rate-limiting the /24 subnets associated with 80.94.92.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>) and 45.148.10.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/NL" target="_blank">NL</a>), which host multiple repeat offenders. Focus on infrastructure patterns: Unmanaged Ltd and TechOff Srv Limited each show high report-to-IP ratios, indicating concentrated malicious use. Deprioritize individual residential IPs from major cloud providers (e.g., Google, Microsoft) unless part of larger clusters, as these reflect opportunistic scanning rather than targeted threats.