Threat Intelligence Briefing

Global threat activity surged +294.5% compared to the prior 6-hour period, with spam (345.6K events) and malicious traffic (126.2K) dominating. This is a significant deviation from typical levels, far exceeding the 7-day average. The US, India, and Russia contributed most to the spike, but no single sustained campaign or infrastructure cluster explains the surge—instead, broad-based increases across residential and datacenter IPs suggest coordinated botnet activation or abuse of transient infrastructure. Nordic countries remained within expected baselines, with SE and FI showing typical patterns of scanning and brute-force activity from anonymizers and malware C2s. Consider temporary blocking or rate-limiting traffic from high-reporting ASNs like Leaseweb USA (6.5K reports) and Bharti Airtel (4.8K), particularly for IPs linked to malware C2 and brute-force clusters. Deprioritize isolated spam sources unless tied to broader patterns. Focus on CIDR ranges tied to datacenter providers showing concentrated malicious behavior, as ephemeral IPs from these networks are likely part of automated attack infrastructure.