Significant Threat
IP 195.47.238.87 is a high-risk address with a threat level of 8/10 that has accumulated 302 abuse reports since September 2025, predominantly linked to automated hacking intrusion attempts detected by honeypot sensors in Sweden.
The IP originates from a Swedish network operated by No ACK Group Holding AB (ASN AS30893) and has been monitored since September 2025, with the most recent activity logged in October 2025. Despite the relatively low current activity frequency of 0/10, the historical report volume of 302 total submissions — all attributed to automated honeypot detections of hacking activity — underscores a persistent threat profile. The confidence score of 66% reflects that while the pattern is well-established, some uncertainty remains in attributing all activity exclusively to this single source. The geographic origin in Sweden places this address within European network infrastructure, and the exclusively honeypot-sourced reports indicate that probes and intrusion attempts have been systematically documented by defensive sensor systems rather than arising from false positives in production environments.
The dominant hacking classification encompasses a broad spectrum of unauthorized access attempts, vulnerability exploitation and intrusion activity. For any exposed service — particularly remote administration interfaces, web applications or network endpoints — this IP represents an active probing threat. The automated nature of the attacks means exposure can result in rapid, repeated attempts to identify weak configurations or unpatched software, increasing the probability of successful compromise if defensive layers are absent or insufficient.
Site operators should treat this IP as hostile and implement immediate mitigations: block or rate-limit access at the firewall level, enforce strong authentication mechanisms such as key-based SSH access, and deploy intrusion detection rules capable of flagging the attack patterns associated with automated reconnaissance tools. Regular patching cycles and monitoring of authentication logs for repeated failed attempts from this address will further reduce risk exposure.
FR 
HK 
VN