Threat Intelligence Briefing

Global threat activity increased by +24.5% compared to the previous 6-hour period, driven primarily by a surge in reconnaissance (104k events) and malware C2 traffic. This deviation from typical volume is concentrated in datacenter and hosting infrastructure, with notable clusters from Alibaba (<a href="https://ip.wayscloud.services/country-intelligence/US" target="_blank">US</a>), DigitalOcean, and Microsoft. While US and China remain top source countries, a cluster of malware C2 IPs from the Philippines (103.11.41.10/20) shows coordinated activity. Nordic exposure remains low but includes known abusive ranges, particularly in Sweden and Denmark, with IPs tied to ssh_brute_force and blacklist activity. Consider temporary blocking or rate-limiting the /24 CIDR ranges associated with 103.11.41.0/24 (<a href="https://ip.wayscloud.services/country-intelligence/PH" target="_blank">PH</a>) and 185.115.164.0/24 due to persistent malware C2 patterns. Deprioritize isolated residential IP events, as they align with routine background noise. Focus on infrastructure-level patterns: hosting providers account for 37% of unique IPs and are disproportionately linked to high-severity categories. Monitor Google and Microsoft ASNs for anomalous outbound connections.