🇸🇪 TI-2026-044B — The Vikings: Internet Vikings and the Gambling-to-Abuse Pipeline

I. The Smoking Gun

The case against Internet Vikings does not begin with a risk score, a marketing brochure, or a guilt-by-association narrative about Nordic privacy culture. It begins with a single Swedish IP in our honeypot: 185.157.91.192 on AS51913, registered to Internet Vikings International AB. Threat score 40.2. Abuse score 68. That is sufficient by itself to move the company out of the category of speculative concern. Whatever else Internet Vikings is—a corporate hosting provider, a gambling specialist, a Swedish B2B infrastructure brand—its own address space is generating hostile traffic visible in direct telemetry. That is the smoking gun.

Once that fact is established, the rest of the profile becomes more disturbing. The entity-level risk score for AS51913 is 81.2 out of 100. In this investigation that score is explicitly compared against many known bulletproof hosts that cluster in the 60–70 range, with Internet Vikings approaching extreme benchmark territory associated with entities like ISAEV at 92.5. The inversion is immediate. A company with a polished public identity, industry-specific sales language, and Swedish corporate registration scores more dangerously than organizations already discussed in threat-intelligence literature as obvious abuse facilitators. That gap between facade and function is the point of the dossier.

The investigation title uses the phrase “the gambling-to-abuse pipeline” because Internet Vikings markets itself almost exclusively to the iGaming sector. That matters not because gambling is inherently criminal, but because the classification supplies legal cover, reputational insulation, and procedural complexity. Investigators approaching a provider branded as gambling infrastructure confront licensing, jurisdictional, and compliance narratives before they confront cybercrime patterns. The company’s public story says “regulated industry specialist.” The telemetry says “attack-generating infrastructure.” Both are true at once.

II. Internet Vikings and the Risk Score Inversion

The strongest analytical result in TI-2026-044B is not that Swedish hosting has risky edges. That would be banal. The stronger result is that the most polished facade in the set produces one of the worst risk profiles. The evidence summary states it cleanly: Internet Vikings operates with risk 81.2/100, higher than PRQ at 22.0, higher than DFRI at 14.4, and higher than the indeterminate but clearly noisy Bahnhof profile exposed through multiple abuse-100 IPs. The company’s website and public presence, meanwhile, center dedicated gambling server hosting, DDoS protection, infrastructure for betting platforms, and jurisdiction-specific regulatory competence. The more professional the facade, the worse the threat picture becomes. That is inversion.

Bulletproof hosts traditionally advertise in ways that already signal risk: offshore rhetoric, anonymity guarantees, extreme tolerance claims, or customer bases impossible to mistake for ordinary business. Internet Vikings does the opposite. It occupies a boring category with a legitimate demand profile. Online gambling requires uptime, DDoS mitigation, latency awareness, multi-jurisdiction hosting, and tolerance for regulatory friction. Those needs overlap almost perfectly with the needs of abuse operators, but the commercial wrapper looks routine. This is why the dossier treats “gambling hosting” not as a client vertical alone but as a classification game. The label makes the infrastructure legible to commerce and illegible to rapid law-enforcement triage.

The linked IP set reinforces the point. Beyond the direct Swedish honeypot hit, the investigation identifies Internet Vikings-linked addresses in France, Latvia, and the United States: 193.70.122.120 with threat 81 and abuse 100; 185.145.245.47 with threat 64 and abuse 100; 166.70.207.2 with threat 32 and abuse 55. Whether by leasing, announcing, managing, or otherwise operating globally distributed IP space, Internet Vikings shows the kind of geographic redundancy and jurisdictional spread usually associated with more openly hostile providers. Sweden supplies the legal home. The infrastructure radiates outward.

III. Gambling Licensing as Legal Cover

Why does the gambling classification matter so much? Because online gambling sits inside a regulatory world built around licensure, financial controls, taxation, regional legality, geofencing, payment relationships, and uptime obligations. That is a different workflow from ordinary abuse handling. A general-purpose hosting provider associated with phishing, intrusion, or malware can be framed quickly as a cybercrime concern. A provider that services licensed betting operators can invoke compliance discussions that slow the translation from suspicious telemetry to decisive intervention. The public existence of real, lawful gambling customers grants the provider a shield against immediate reputational collapse.

That shield is structural, not merely rhetorical. A specialist gambling host already expects DDoS events, geo-blocking disputes, rapid capacity shifts, and multiple regulatory interfaces. Those expectations normalize the presence of hardening techniques and jurisdictional dispersion that would appear suspicious in another business category. The very operational features that legitimate gambling clients demand—resilience, redundancy, distributed infrastructure, anti-disruption posture—also make the environment attractive for actors who need cover for hostile traffic. A company does not need to advertise abuse tolerance if it already sells the engineering traits abuse operators value.

The dossier does not argue that every gambling host is malicious. It argues that gambling hosting is unusually effective camouflage for risk-heavy infrastructure. Internet Vikings is the primary case because the evidence base pairs that camouflage with hard telemetry. Once a provider in this category produces direct honeypot hits from its own ASN and carries an 81.2 risk score, the category itself becomes analytically important. The business label is not an explanation away from the danger. It is part of how the danger remains marketable.

IV. Mapping the Swedish Hosting Cluster

Internet Vikings matters most as a node inside a larger Swedish cluster. The investigation identifies 19 Swedish ASNs in honeypot search results: Telia, Svea, Telenor, Net at Once, Internetport, Ownit, Sandviken Energi, Ljusnet, Glesys, Bahnhof, No ACK, DFRI, Bredband2, PRQ, Internet Vikings, Hjelm, GlobalConnect, QuxLabs, and PatrikWeb. For a country of roughly 10.5 million people, that concentration is striking. Sweden is not Europe’s largest economy, not its largest population center, and not historically its most obvious mass-hosting hub. Yet its infrastructure density in hostile telemetry is disproportionate.

This density matters because it changes how abuse survives. In classic bulletproof jurisdictions, infrastructure may be concentrated in a handful of notorious networks. Concentration helps reputation catch up. Sweden’s pattern is more distributed. Large ISPs, medium commercial hosts, advocacy-linked networks, legacy privacy providers, and micro-operators all coexist within one legal and cultural environment. Some of these ASNs are baseline consumer networks that naturally contain compromised devices or noisy customers. Others are clearly more operationally interesting. But the ecosystem effect is what matters: the cluster as a whole normalizes Swedish-origin infrastructure as both common and hard to summarize with a single label.

That ambiguity is advantageous. A hostile operator does not need every Swedish ASN to be dirty. It is enough that the jurisdiction offers many neighboring options spanning consumer broadband, boutique hosting, privacy-centric brands, and globally leased infrastructure. If one route becomes noisy, another remains available. If one provider attracts press, another looks mundane. If one part of the stack requires direct ownership, another part can be leased. The cluster functions like an ecology, not a cartel. That is why the dossier enumerates 19 ASNs instead of fixating only on the loudest names. Sweden’s role is systemic.

V. PatrikWeb and the Low-Barrier Swedish ASN Problem

If Internet Vikings is the polished enterprise face of the problem, PatrikWeb is the stripped-down proof that the barrier to dangerous hosting in Sweden can be extremely low. IP 171.25.158.80 on AS35100, registered as PatrikWeb-Core to Patrik Lagerman, carries threat score 91.0 and abuse score 100—the highest Swedish IP in the dataset. That number matters because it exceeds not just mainstream providers but nearly everything in the Swedish sample. One individual or micro-operator can, under Swedish conditions, control infrastructure more dangerous than entire household-name networks.

This is not merely a curiosity. It shows how distributed the Swedish ecosystem really is. When analysts imagine risky infrastructure they often picture large companies with compliance teams, datacenters, marketing arms, and sales funnels. PatrikWeb demonstrates the opposite end of the scale: a small provider with disproportionate impact. The ecosystem therefore has two reinforcing advantages. Larger players like Internet Vikings can hide behind professional specialization. Smaller players can hide behind obscurity and scale. Both benefit from the same jurisdictional permissiveness and the same cultural backdrop that treats hosting as neutral until proven otherwise.

The presence of a second PatrikWeb IP, 171.25.158.74 with threat 27, matters too. It indicates repetition, not a one-off outlier. The Swedish problem is not that a few big brands accidentally host bad customers. It is that the jurisdiction makes room for both enterprise-grade cover and micro-scale high-risk operations. When that combination exists inside one country, infrastructure migration becomes easy. An operator can move laterally without leaving the same legal climate.

VI. The M247 Link and the Triangle Closure

The appearance of M247 inside Swedish territory is a second-order finding with strategic weight. IP 45.151.73.144 on AS9009, attributed to M247 Europe SRL with Swedish presence, appears in the honeypot at threat 50 and abuse 100. M247 has already featured in prior dossiers as a Romanian corridor provider and as part of the routing substrate around major VPN brands. Its Swedish presence closes a triangle described in the investigation: Romania, Lithuania, and Sweden as linked nodes in the broader Nordic/Baltic abuse environment.

Why does that matter here? Because it shows that Swedish hosting is not isolated or merely national. External actors route into Sweden because the jurisdiction adds value. If a Romanian-origin provider chooses to maintain Swedish presence that later appears in hostile telemetry, Sweden is functioning as a destination layer for already-risky infrastructure. That is analytically different from domestic abuse alone. It means the country’s regulatory and reputational advantages are exportable. Foreign infrastructure operators treat Swedish presence as worth acquiring.

In practice this means defenders should stop treating country of incorporation and country of operation as interchangeable. A provider may be Romanian, Lithuanian, French, Australian-owned, or American-connected and still use Swedish geography for part of the hostile stack. Internet Vikings embodies the inverse: Swedish corporate identity with globally distributed IP space. M247 shows the mirror image: foreign network actor with Swedish operational foothold. Together they define Sweden not as an isolated anomaly but as a junction.

VII. Gigahost Norway and the Wider Nordic Pattern

The dossier is centered on Sweden, but the Norwegian Gigahost cluster proves that the pattern is regional. AS56655, Gigahost AS, carries risk 70.5/100 and contributes 15 honeypot IPs, all with abuse score 100. Key nodes include 193.200.229.243 and 185.243.218.225 at threat 78, plus multiple neighboring addresses in the same cluster. This is not normal background noise. It is concentrated high-abuse infrastructure under a conventional Nordic hosting identity.

Gigahost matters because it removes the last refuge of the “isolated provider” explanation. If Internet Vikings were unique, one might call it a corporate anomaly. If PatrikWeb were unique, one might call it a micro-operator problem. When Norway also contributes a 15-IP, abuse-100 cluster under a businesslike hosting banner, the better explanation is regional hosting culture: affluent jurisdictions, strong digital infrastructure, reputational legitimacy, and regulatory environments that do not immediately collapse under abuse pressure. Sweden is the most complex and most instructive case, but it is not alone.

The comparison also clarifies the Swedish distinction. Norway’s Gigahost looks like concentrated risk from one company. Sweden looks like a broad spectrum ranging from telecom baseline noise to privacy brands to boutique hosts to gambling-specialist infrastructure. Norway offers a parallel. Sweden offers a full ecosystem. That is why the Swedish case deserves its own article and why the Norwegian cluster strengthens rather than dilutes it.

VIII. Sweden Versus Finland and Denmark

The contrast data in the investigation is useful because it shows what Sweden is not. Finland’s honeypot presence is described as dominated by Hetzner’s Finnish datacenter presence—German hosting using Finnish geography. Denmark’s presence clusters around DotSrc, a non-profit association model with fewer native ASNs. Sweden is different. It is not simply foreign hyperscale using local land, nor a narrow relay phenomenon. It is a domestic hosting ecosystem with multiple native actors occupying multiple functional niches.

That distinction matters because it affects intervention options. If Finland’s footprint is largely an extension of German infrastructure, then pressure can be conceptualized through the foreign parent. If Denmark’s footprint is smaller and more association-centered, the national case is narrower. Sweden, by contrast, presents an endogenous cluster. Its risk profile emerges from a national hosting culture that includes major ISPs, privacy-linked brands, gambling infrastructure specialists, legacy anti-censorship hosts, and tiny individual operators. That density is why Sweden can replace Switzerland in telemetry share. It has enough native variety to serve as a complete operational environment.

In short: Finland provides geography. Denmark provides selected relays. Sweden provides an ecosystem. That is why the Internet Vikings finding matters beyond one company. It reveals the most commercially polished face of a national environment already rich in infrastructure options for hostile use.

IX. Complete Enumeration: 30 Swedish IPs Across 12 ASNs

Enumeration matters because it prevents the dossier from collapsing into a narrative about a few famous names. The evidence base explicitly lists 30 Swedish IPs across 12 ASNs in direct honeypot results. Some are consumer or access-network addresses likely representing compromised endpoints or residential misuse. Others belong to hosting providers with reputational or structural significance. Together they define the Swedish hostile-telemetry surface. The table below preserves that surface as data rather than metaphor.

Two cautions are important. First, presence in honeypot data does not imply every ASN in the list is intentionally malicious. Large access networks naturally include compromised customers. Second, that caution does not weaken the broader finding. What matters is the combined density of Swedish-origin hostile traffic and the concentration of especially meaningful cases—Internet Vikings, PatrikWeb, Bahnhof, PRQ, and M247’s Swedish presence—inside the same jurisdiction. Enumeration is how we distinguish systemic pattern from selective outrage. Sweden remains overrepresented even after the benign explanations are granted their due.

X. Why the Swedish Model Scales

The reason this model scales is that each layer solves a different operational problem without looking like a crime-enabling layer in isolation. Consumer and access networks provide volume and deniability. Boutique or micro-hosting providers provide concentrated risk at low visibility. Legacy privacy brands provide ideological and reputational cover. Gambling specialists provide commercial legitimacy for hardening features such as DDoS resilience and multi-jurisdiction deployments. Foreign operators such as M247 add cross-border elasticity. When all of those coexist in one jurisdiction, an attacker does not need a single bulletproof host. The ecosystem itself behaves like a distributed bulletproof environment. Pressure on one node simply shifts activity to another node with similar protective traits.

This is also why Sweden can outperform more notorious jurisdictions in practice while appearing cleaner in public debate. Notoriety eventually becomes self-limiting: banks scrutinize it, reporters flag it, and investigators treat it as presumptively suspicious. Sweden benefits from the opposite dynamic. Its infrastructure is discussed through innovation, rights culture, and business professionalism. That reputational baseline buys time. A provider can accumulate risky traffic, lease or manage global IP space, and still be approached first as a legitimate enterprise. Time matters in abuse infrastructure. The longer a network can remain inside the category of ordinary business, the more valuable it becomes.

The distributed nature of the Swedish cluster also changes defensive triage. Analysts cannot solve the problem by blacklisting one company or one famous ASN. Internet Vikings is central because the evidence is strong, but it is not sufficient as a sole target. The same dataset that exposes AS51913 also exposes PatrikWeb, Bahnhof, PRQ, Net at Once, Glesys, Ownit, Bredband2, and Swedish presences of foreign operators. Some of these require abuse response. Others require intelligence collection. Others require watching for later migration. The lesson is structural: Sweden offers enough local variety that operators can assemble attack-capable infrastructure from interchangeable parts. That is the hallmark of a mature ecosystem.

That is why the Internet Vikings result should be read as a warning about future infrastructure, not only present abuse. Once a jurisdiction discovers that legitimacy itself can be operational capital, more providers will copy the formula. They do not need to declare impunity. They only need to occupy a market segment where hardening, compliance complexity, and geographic dispersion already make sense. Sweden has demonstrated that this formula can sustain both large branded providers and tiny individual operators under the same national umbrella. The next generation of abuse infrastructure will prefer that model over openly disreputable hosting because the defenses activate later and the public story remains plausible for longer.

XI. Final Assessment

The Swedish hosting story in TI-2026-044B is not that Scandinavia secretly houses cartoon villains. It is more consequential than that. Sweden has produced a business environment in which highly defensible commercial categories—privacy, telecom, and now gambling infrastructure—can host or mask operationally relevant attack traffic without immediately forfeiting legitimacy. Internet Vikings is the clearest embodiment because its facade is the cleanest and its risk score among the worst. AS51913 at 81.2, plus the direct honeypot appearance of 185.157.91.192, is enough to establish the pipeline from lawful market category to hostile infrastructure relevance.

PatrikWeb shows that dangerous Swedish infrastructure can exist at tiny scale. Bahnhof and PRQ show that historically privacy-forward providers continue to surface in hostile telemetry. M247’s Swedish presence shows foreign actors value the jurisdiction enough to route through it. Gigahost in Norway shows the regional pattern is real. The 30-IP enumeration shows the exposure is broad, not anecdotal. Every layer points in the same direction: Nordic legitimacy is not an obstacle to abuse. It is often part of the cover that makes abuse sustainable.

The evidence therefore supports a hard conclusion. Gambling hosting in Sweden is not merely adjacent to hostile infrastructure. In the Internet Vikings case it is one of the mechanisms by which hostile infrastructure becomes commercially plausible, globally distributed, and publicly deniable. The better the facade, the more dangerous the function can become. That is not opinion. That is what the scores, the IPs, the ASNs, and the honeypot hits show.