89.109.23.154 has a low threat confidence level of 22%, originating from Nizhniy Novgorod, Russia, on the Rostelecom network (12389). It has been observed across 25 sessions targeting SMB, First observed on February 9, 2026, most recently active March 7, 2026.