Elevated Risk
IP 195.47.238.93 is a high-risk address operating from Swedish network infrastructure that has been flagged by automated honeypot sensors with 181 abuse reports and a threat level of 8 out of 10, indicating a consistent and dangerous pattern of intrusion activity. The IP demonstrates an activity frequency score of 8 out of 10, placing it among the most persistently active hostile sources currently monitored. The overwhelming majority of recent reports categorize the activity as general hacking attempts, including exploitation attempts and unauthorized access probes against exposed services.
Detection data collected between September 2025 and January 2026 shows sustained malicious behavior originating from this address, with all 20 recent reports attributing the activity to automated honeypot sensors rather than community reporting. The IP is registered to No ACK Group Holding AB and operates within AS30893, a Swedish autonomous system. With a confidence score of 91 percent, analysts can place substantial weight on the reliability of these findings. The geographic origin in Sweden does not indicate any reduced threat posture, as threat actors routinely route traffic through compromised infrastructure in well-connected regions to obscure their true point of origin.
Hacking activity of this nature represents an active intrusion threat to any exposed service listening on common ports. Such probes typically precede more targeted attacks, scanning for outdated software with known exploits, misconfigured authentication mechanisms, or weak credentials that can be brute-forced. Organizations with SSH, RDP, web interfaces, or database services exposed to the internet face the highest risk from this source. The volume and persistence of reports suggest this IP participates in automated attack campaigns that systematically sweep large portions of the internet seeking vulnerable entry points.
Site operators should treat this IP as a confirmed threat source and implement immediate blocking at the network perimeter firewall or intrusion prevention system. Deploying tools such as fail2ban or equivalent rate-limiting solutions can automatically ban IPs after repeated failed authentication attempts. All exposed services should enforce strong password policies, disable default credentials, and ensure software patches are current. Continuous monitoring of authentication logs for connections originating from this address will help identify any successful intrusion attempts that may require incident response procedures.
BG 
UA