89[.]22[.]231[.]63

Posts referencing this indicator

• From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

  FFortinet

  Primary post-escalation operator IP; also observed as destination of unusual outbound connection from Jenkins host on port 8080, linking host activity to cloud control-plane abuse

  2026-07-06