Extreme Threat
IP 23.95.188.50 is a critical-risk address operating from the United States within AS36352 (AS-COLOCROSSING) that has generated 644 abuse reports, all documenting sustained hacking activity including intrusion attempts, vulnerability exploitation and unauthorized access campaigns, making it a severe and active threat to any exposed service.
The data reveals an extremely concerning profile: a perfect threat-level score of 10/10 paired with a 94% confidence rating confirms this is not noise but a deliberate, persistent attacker. All 644 reports cite hacking as the threat category, with activity frequency rated 8/10 indicating near-continuous offensive operations. Detection originated exclusively from automated honeypot sensors distributed across the security community, validating the malicious intent through multiple independent observations. The entire reported activity window spans December 2025, meaning this address was actively engaged in hostile probing during that period. AS-COLOCROSSING is a network operator frequently associated with aggressive scanning infrastructure, which contextualises why this particular address is generating such volume.
Hacking activity in this context encompasses systematic intrusion attempts ranging from vulnerability scanning and exploit delivery to credential stuffing and targeted service exploitation. The real-world risk is concrete: an exposed SSH, RDP, web application or any network servicefront facing this address faces automated brute-force and exploitation tooling that will repeatedly probe for weak configurations, unpatched software or misconfigured authentication. With activity frequency at 8/10, defenders should assume this IP operates as part of an ongoing automated campaign rather than isolated probing.
Site operators should treat this IP as definitively hostile and block it at the network perimeter without deliberation. Implement fail2ban, iptables rules or equivalent rate-limiting to automatically drop connections from repeat offenders. Enforce strong authentication policies across all internet-facing services, disable unused protocols, and ensure all software remains current with security patches. Continuous traffic monitoring and log analysis will help identify any successful intrusion attempts originating from such sources.
RO 
FR 
SE 
TR