Is 89.58.41.156 a VPN? Yes — Tor.

Yes. 89.58.41.156 is a confirmed VPN exit operated by Tor. Multiple ground-truth intelligence sources agree (Tor, firehol-anonymizers), so the false-positive risk is very low.

89.58.41.156 is announced by AS197540 (netcup GmbH), located in Germany. The holder of the announced BGP prefix 89.58.40.0/22 is netcup-AS netcup GmbH. You can look up other IPs on the same network via the IPLogs ASN directory.

If you run a fraud, payments, or streaming surface, yes — block this IP or require step-up auth. For most general consumer sites, allow read access but step up before any sensitive write (login, password reset, checkout).

It depends on your threat model. The IP itself is not malicious by default — VPN traffic is legal and widely used. But because it masks the user's real network, you can't tell who is behind it. For high-trust actions (payments, passwords) treat it as untrusted.

If you visited iplogs.com from your own connection and were flagged vpn detected, the cause is one of: a VPN client on your device or network, a corporate proxy, a CGNAT pool that overlaps with VPN exits, an ISP-level DNS resolver routing through Cloudflare/Apple infrastructure, or your IP being on a published commercial-VPN relay list. The "Why this IP is flagged" section above lists every source that matched — that's the dispute trail.

Hit our public API: `POST https://iplogs.com/v1/check` with body `{"ip":"89.58.41.156"}`. You get back a JSON verdict, score 0–1, every matched signal, ASN/geo info, and the full provenance list. Free, no signup, no API key. See /docs for client examples in curl, Python, Node.js and Go.