102.129.55.44📋 Copy

# IP Intelligence Briefing: 102.129.55.44/32

## Executive Summary

Classification: Moderate Risk (Score: 40)

Location: Vanderbijlpark, Gauteng, South Africa (ZA)

ASN: 327991 | Organization: Jacobus De Beer | Block: 102.129.55.0/24

Status: Multi-Service Host with active web and SSH services

## Risk Assessment

The IP maintains a moderate risk score of 40/100. No active threat indicators detected—no known attacker flags, spam source designation, or Tor exit node classification. Blacklist status shows 2 DNSBL listings out of 8 total lists evaluated. The IP is not persistently malicious with zero threat observation count and no campaign correlations.

## Network Characteristics

• Service Profile: HTTP (port 80/tcp) and SSH (port 22/tcp) services active
• SSH Banner: SSH-2.0-ROSSSH (identified SSH server variant)
• DNS Resolution: Forward confirmed to ms-55-44.megasurf.co.za (co.za TLD)
• Email Authentication: SPF and DMARC records present
• Network Classification: Not cloud, CDN, VPN, proxy, hosting, mobile, residential, or bogon

## Subnet Analysis (102.129.55.0/24)

• Total Active Siblings: 99
• Risk Distribution: High (0), Medium (49), Low (22)
• Abuse Density: 0
• Threat Siblings: 0
• Inherited Risk: 0

The subnet exhibits moderate activity with nearly half of active peers classified as medium risk. The target IP does not inherit elevated risk from neighbors.

## Control Plane Indicators

• BGP Prefix: 102.129.48.0/21
• Route Stability: Unstable (route changes detected in last 30 days)
• DNSSEC: Valid
• DNSBL Status: Listed on 2 of 8 evaluated lists
• Operator Score: 0.2609 (Basic)

## Historical Observations

16 signal observations recorded. Latest activity captured 2026-07-18, showing consistent service availability with SSH and HTTP endpoints. No significant shifts in geolocation or ownership patterns detected.

## Recommended Actions

• Monitor SSH port 22 for unauthorized access attempts
• Review DNSBL listing origins for potential false positives
• Consider enhanced logging for incoming connections to port 80 and 22
• Subnet-level monitoring recommended due to 49 medium-risk peers

## Intelligence Notes

IP resolves to a South African residential/commercial host under Jacobus De Beer organization. The "ROSSSH" SSH banner indicates a common open-source SSH server implementation. No direct correlation to known threat actors or campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.