I found the IP address 149.154.175.50 in my network logs related to Telegram and I'm a bit confused. I've seen conflicting information from different IP lookup services and I'm hoping someone can clarify what this IP belongs to or what business is connected to it.
2 Answers
When monitoring security, the IP itself isn't the main concern; it's the traffic patterns that matter. The 149.154.x.x IPs are used globally for Telegram, so it's normal to see them in logs. Rather than focusing on the ownership of the IP, look into whether the traffic matches normal app behavior. Analyze the ports used, how often connections happen, and which endpoints are involved. This will help you distinguish between legit and suspicious traffic.
That IP belongs to Telegram Messenger, as indicated by AS59930. Can you provide more context about what you’re seeing?
I did check a couple of sites, and one said it's linked to Telegram_Messenger_Network AS62041 while another mentioned Telegram AS43739. Just trying to get to the bottom of my network logs.