Threat Intelligence Briefing

Threat activity surged globally, increasing +122.5% compared to the prior 6-hour period, with 303,825 total threats reported—well above the 7-day average. The spike was driven primarily by reconnaissance (104,334 events) and malware infrastructure (54,131) campaigns, concentrated in US, CN, and DE. Nordic countries remained below 2,000 combined threats, with SE and FI showing typical patterns; NO and DK volumes were stable. Notably, multiple IPs from DigitalOcean and Microsoft Corp were linked to repeat SSH brute-force and scanning activity, indicating abuse of cloud infrastructure rather than isolated incidents. Consider temporary blocking or rate-limiting the /24 ranges associated with <a href="https://ip.wayscloud.services/ip-intelligence/80.94.92.128" target="_blank">80.94.92.128</a> (<a href="https://ip.wayscloud.services/country-intelligence/RO" target="_blank">RO</a>) and <a href="https://ip.wayscloud.services/ip-intelligence/20.205.37.29" target="_blank">20.205.37.29</a> (<a href="https://ip.wayscloud.services/country-intelligence/HK" target="_blank">HK</a>), both tied to multi-category malicious behavior. Focus on patterns: SSH brute-force clusters from US and TR-based hosting providers are deviating from baseline. Deprioritize isolated residential IP reports, as they reflect routine background noise. Monitor for persistence in <a href="https://ip.wayscloud.services/ip-intelligence/92.118.39.49" target="_blank">92.118.39.49</a> and <a href="https://ip.wayscloud.services/ip-intelligence/176.53.159.197" target="_blank">176.53.159.197</a>, which may indicate coordinated scanning.