See: https://www.threatminer.org/host.php?q=8.248.5.254
VirusTotal on this https://www.virustotal.com/gui/ip-address/8.248.5.254/details
and relations and dectedtions: https://www.virustotal.com/gui/ip-address/8.248.5.254/relations
Consider: https://ipinfo.io/AS3356 → https://mxtoolbox.com/SuperTool.aspx?action=mx%3A254.5.248.8.in-addr.arpa&run=toolpage
polonus