5.231.89.54
Classification: Suspicious
5.231.89.54 is a suspicious IP address in Frankfurt am Main, DE. Linked to Revil malware. 3 sightings, last seen 2026-10-09.
Current activity
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: REVIL (S0496)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2026-03-09 01:12:28 | 2026-10-09 11:34:50 | anonymization vpn | |
| DeepScan:Generic.Ransom.Sodinokibi | Hybrid-Analysis | 2020-03-31 02:45:21 | 2020-07-26 10:17:06 | S0496 REvil |
Whois information
- AS name
- AS12586 GHOSTnet Network used for VPS Hosting Services
- AS registry
- ripencc
- AS date
- 2012-09-11 00:00:00
- AS CIDR
- 5.230.0.0/15
- CIDR
- 5.231.89.0/24
- Registrant
- GHOSTnet Network used for VPS Hosting Services
- Address
- Am Dachsbau 17 65812 Bad Soden a. Ts. Deutschland
- City
- Frankfurt am Main
- Postal code
- 60256
- Country
- DE — Germany 🇩🇪
- Contact email
- [email protected]
- First indexed
- 2020-03-31 02:45:21
- Last updated
- 2026-10-09 11:34:52