102.64.33.74📋 Copy

# IP Intelligence Briefing: 102.64.33.74/32

## Executive Summary

IP address 102.64.33.74 was assessed as Moderate Risk (risk score: 55/100) with no active threat indicators. The address is associated with residential hosting infrastructure in South Africa and exhibits elevated risk within its subnet context.

## Ownership and Registration

• Organization: Jacobus De Beer
• ASN: 327991
• CIDR Block: 102.64.33.0/24
• RIR: AfriNIC
• Registration: Current ownership confirmed

## Geolocation

• Country: South Africa (ZA)
• Region: Gauteng
• City: Vanderbijlpark
• Coordinates: -30.56°S, 22.94°E
• Accuracy Radius: 800km
• Timezone: Africa/Johannesburg

## Network Classification

• Infrastructure Type: Firewalled / No Services
• Open Ports: None detected
• Cloud/CDN/VPN Status: None detected
• Service Purpose: No active services
• Tor Exit Node: No

## DNS Analysis

• PTR Hostname: ms-33-74.megasurf.co.za
• Forward Resolution: Confirmed
• Email Authentication: SPF and DMARC records present
• Hosted Domains: None

## Threat Intelligence

• Blacklist Count: 3 DNSBL listings
• Known Campaigns: None
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not applicable
• Threat Feeds: None correlated

## Neighborhood Analysis (102.64.33.0/24)

• Total Siblings: 88
• Active Siblings: 36
• Threat Siblings: 13 (14.77% abuse density)
• Subnet Classification: Mostly clean
• Inherited Risk: 5/100

## Historical Observations

The IP has 14 recorded observations with consistent geolocation signals to South Africa. Recent observations (July 2026) confirm stable ownership with zero threat observation count and no persistent malicious behavior detected.

## Control Plane Assessment

• BGP Prefix: 102.64.32.0/21
• Route Stability: Unstable
• RPKI State: Not verified
• DNSSEC: Valid
• MOAS: No

## Recommended Security Actions

Immediate Monitoring

• Increase logging verbosity for all traffic from this IP
• Review recent activity patterns for anomalies

Firewall Rules

iptables:

```

iptables -A INPUT -s 102.64.33.74 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 102.64.33.74 drop

```

nginx:

```

deny 102.64.33.74;

```

Cloud/WAF Integration

• Cloudflare WAF: Block IP 102.64.33.74
• AWS WAF: Add 102.64.33.74/32 to deny list

## Threat Intelligence Narrative

IP 102.64.33.74 demonstrated moderate risk characteristics without active malicious behavior. The address resolved to a residential hosting infrastructure hostname (ms-33-74.megasurf.co.za) in Vanderbijlpark, South Africa. While the IP itself showed no threat indicators, the subnet exhibited elevated abuse density at 14.77%, with 13 out of 88 total sibling IPs flagged as threats. The presence of 3 DNSBL listings suggests prior reputation issues. No open services were detected, indicating the IP may be passive or firewalled. The inconsistent route stability and lack of persistent malicious behavior suggest this may be a newly allocated or infrequently used address. SOC analysts should monitor for traffic patterns but may consider blocking at the perimeter given the subnet-level risk context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.