64.89.160.73📋 Copy

# IPDEBRIEF INTELLIGENCE BRIEFING

IP Address: 64.89.160.73/32

Classification: Moderate Risk (50/100)

Date of Assessment: 2026-07-24

## Executive Summary

IP 64.89.160.73 belongs to Ghosty Networks LLC (ASN 205759) and presents a moderate risk profile (score: 50). The IP is geofenced as Boston, US but exhibits geolocation inconsistencies across data sources. The subnet (64.89.160.0/24) demonstrates elevated abuse density (0.3), with 12 high-risk and 15 medium-risk neighboring IPs. No active threat indicators or open services were detected.

## Network Ownership & Infrastructure

• Organization: Ghosty Networks LLC
• ASN: 205759
• CIDR Block: 64.89.160.0/23
• RIR: ARIN
• Geolocation: US-MA (Boston) with conflicting reports from Luxembourg and Kansas in historical observations
• Network Classification: Firewalled / No Services detected

## Threat Assessment

The IP shows no direct threat indicators:

• Not a known attacker or spam source
• Not a Tor exit node
• No active threat campaigns correlated
• Blacklist count: 0

However, control plane data reveals the IP is listed on 2 of 8 DNSBLs, indicating prior reputation issues. The operator score (0.1304) is classified as "Minimal," suggesting limited malicious operator activity.

## Neighborhood Analysis

The /24 subnet (64.89.160.0/24) contains 40 sibling IPs with concerning abuse patterns:

• Abuse Density: 0.3 (30%)
• Risk Distribution: 12 high-risk, 15 medium-risk, 13 low-risk IPs
• Notable High-Risk Neighbors: 64.89.160.22, 64.89.160.23, 64.89.160.25, 64.89.160.26, 64.89.160.28, 64.89.160.30, 64.89.160.33, 64.89.160.34, 64.89.160.36, 64.89.160.37, 64.89.160.38, 64.89.160.40, 64.89.160.135

One historical observation correlated with AS12036 (isp associates inc. dba dixie-net, Ripley, MS) with reputation 0 and threat flags active.

## Behavioral Indicators

• Ownership Stability: No changes recorded; persistently stable
• Threat Persistence: 0 days; not persistently malicious
• Network Role: Infrastructure type undetermined; no CDN, hosting, or proxy indicators
• Traceroute: 15 hops via Comcast and GTT transit networks

## Recommended Actions

Based on the moderate risk profile and neighborhood context, the following firewall rules are recommended:

iptables:

```

iptables -A INPUT -s 64.89.160.73 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 64.89.160.73 drop

```

nginx:

```

deny 64.89.160.73;

```

Cloudflare WAF:

```json

{

"description": "Block 64.89.160.73 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 64.89.160.73"

}

}

```

AWS WAF:

```json

{

"Addresses": ["64.89.160.73/32"],

"Description": "IPDebrief risk 50"

}

```

## Intelligence Assessment

The IP should be treated with caution due to neighborhood abuse density and DNSBL listings. While no active malicious behavior was observed at the time of assessment, the subnet's high-risk neighbor concentration suggests potential for coordinated abuse. Monitor for changes in threat indicators and geolocation consistency.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.