64.89.163.68📋 Copy

# IP Intelligence Briefing: 64.89.163.68/32

Classification: Moderate Risk (Score: 50)

Date: 2026-07-27

## Ownership & Infrastructure

The IP address 64.89.163.68 is registered to Meowcore Softworks LLC (ASN 401626) under the netname "MEOWCORE" within the 64.89.163.0/24 CIDR block. The infrastructure is classified as a Single-Service Host with geolocation data indicating United States origin. The IP is not associated with cloud, CDN, VPN, proxy, Tor, or hosting services.

## Threat Assessment

Risk Profile: Moderate Risk (50/100)

• No known threat indicators detected
• Not classified as Tor exit node, known attacker, or spam source
• Zero blacklist entries
• No associated threat campaigns
• No evidence of persistent malicious behavior

Control Plane Status:

• DNSBL listed on 2 of 8 threat lists
• Route changes observed: 0 (30-day window)
• Route stability: False

## Network Services

• Open Ports: TCP/3389 (RDP)
• DNS: No forward resolution confirmed; no PTR records
• Email Authentication: SPF and DMARC records absent
• HTTP: No TLS certificate or HTTP title detected

## Neighborhood Analysis

The /24 subnet 64.89.163.0/24 contains 38 total sibling IPs with 17 currently active. Abuse density is low at 0.0263, and subnet classification is "clean." Risk distribution across neighbors shows:

• High Risk: 0 IPs
• Medium Risk: 2 IPs
• Low Risk: 35 IPs

One threat sibling detected within the subnet, indicating minimal neighborhood contamination.

## Historical Observations

17 observations recorded as of 2026-07-27. Signals include port scanning activity with confidence levels ranging from 0.30 to 0.90. No evidence of ownership changes or threat persistence detected.

## Relationships

Two relationship entries identified, both classified as "Same Network" targeting MEOWCORE organization.

## Recommended Actions

Due to moderate risk scoring (50) and RDP exposure, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 64.89.163.68 -j DROP

# nftables

nft add rule inet filter input ip saddr 64.89.163.68 drop

# nginx

deny 64.89.163.68;

# pfSense

64.89.163.68/32

# Cloudflare WAF

ip.src eq 64.89.163.68 → BLOCK

# AWS WAF

Addresses: ["64.89.163.68/32"]

```

---

Analyst Notes: The RDP exposure on this IP represents a potential attack vector. While the IP itself lacks direct threat indicators, the moderate risk score warrants blocking. Monitor for associated activity from the MEOWCORE network prefix if blocking is implemented.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.