5.101.50.209
Classification: Suspicious
5.101.50.209 is a suspicious IP address in Saint Petersburg, RU. Linked to Socgholish malware. 370 sightings from 5 threat sources, last seen 2026-10-17.
Current activity
- Open proxy — Provides anonymization that can hide an attacker.
- Hosting provider — Shared hosting infrastructure.
MITRE ATT&CK associations
Malware families: SOCGHOLISH (S1124)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Proxy | FireHOL | 2026-05-08 08:00:39 | 2026-10-17 18:10:10 | anomalous-activity anonymization proxy | |
| Anonymizer | FireHOL | 2026-05-08 07:03:52 | 2026-10-17 17:13:21 | anomalous-activity anonymization | |
| Proxy | IPWhois.io | 2026-09-03 02:56:05 | 2026-10-03 08:50:04 | anonymization proxy | |
| FAKEUPDATES | ThreatFox Abuse.ch | 2024-07-04 15:18:50 | 2024-07-06 14:21:57 | malicious-activity | S1124 SocGholish |
| SSH Attacker | Blocklist.de | 2020-02-28 00:49:19 | 2020-02-28 07:13:19 | ||
| Malicious Host | HoneyDB | 2020-02-27 00:00:00 | 2020-02-27 00:00:00 |
Tags
ssh bruteforce bot keitarotds socgholish port:443 fakeupdate anonymizationWhois information
- AS name
- AS49505 JSC Selectel
- AS registry
- ripencc
- AS date
- 2012-06-26 00:00:00
- AS CIDR
- 5.101.48.0/22
- Registrant
- JSC Selectel
- City
- Saint Petersburg
- Postal code
- 191186
- Country
- RU — Russian Federation 🇷🇺
- First indexed
- 2020-02-28 00:49:19
- Last updated
- 2026-10-17 18:10:10