102.64.33.204📋 Copy

## IP Intelligence Briefing: 102.64.33.204/32

Executive Summary

Threat Level: HIGH RISK (80/100) – IP 102.64.33.204 presents elevated threat indicators despite being assigned to a residential ISP block in Vanderbijlpark, South Africa. The IP shows DNS-based threat signals and firewalling behavior inconsistent with normal residential usage.

---

IP Ownership & Network Classification

Threat Assessment

• Risk Score: 80 (High Risk)
• Reputation: High Risk
• Blacklist Count: 0
• DNSBL Listed: 4 of 8 lists
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• Service Status: Firewalled / No Services (HTTP blocked)

Network Role & DNS Intelligence

• PTR Hostname: ms-33-204.megasurf.co.za
• Forward Resolution: ms-33-204.megasurf.co.za
• Domain: co.za
• Email Auth: SPF: Yes, DMARC: Yes
• Service Purpose: Firewalled / No Services

Control Plane & Routing

• BGP Prefix: 102.64.32.0/21
• Origin ASN: 327991
• Route Stability: False (changing routes)
• RPKI State: Not verified
• Operator Score: 0.2609 (Basic)
• DNSSEC Valid: Yes

Behavioral Analysis & History (16 Observations)

• Ownership Changes: 0 (Stable)
• Threat Persistence Days: 0
• Persistent Malicious Activity: No
• Recent Classification: "mostly_clean" subnet with 0.15 abuse density
• Geolocation Confidence: 0.52 (inferred)

Neighborhood Analysis (102.64.33.0/24)

• Total Siblings: 100 IPs
• Abuse Density: 0.02 (Low)
• Active Siblings: 53
• Threat Siblings: 15
• Risk Distribution: 2 High Risk, 77 Medium Risk, 20 Low Risk

Related Entities

• DNS Associations: ms-33-204.megasurf.co.za
• Network Associations: 102.64.33.0 - 102.64.33.255

---

Intelligence Narrative

IP 102.64.33.204 is assigned to Jacobus De Beer's residential ISP block in Vanderbijlpark, South Africa. Despite the subnet showing low abuse density (0.02), this specific IP carries a risk score of 80, indicating anomalous behavior or association with malicious activity. The IP responds to DNS queries with a reverse lookup pointing to a Megasurf hostname, but services remain inaccessible (firewalled/no services detected).

The IP is DNSBL-listed on 4 of 8 monitored lists, suggesting reputation degradation. While no open ports or services are detected, the combination of high-risk classification, DNSBL presence, and firewalling behavior warrants monitoring. The subnet contains 15 threat siblings out of 100 IPs, indicating localized abuse potential.

---

Recommended Actions

1. Monitor – Add to SIEM for traffic pattern analysis

2. Block – Implement egress/ingress firewall rules if inbound connections observed

3. Investigate – Check for DNS queries to ms-33-204.megasurf.co.za

4. Correlate – Review traffic from other 102.64.33.0/24 IPs with risk scores >40

---

*Intelligence generated: 2026-07-30 | Source: IPDebrief Threat Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.