# 102.64.36.115 — IP Intelligence Summary

102.64.36.115 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-36-115.megasurf.co.za. As of October 6, 2026, IPDebrief rates it Low Risk (15/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/102.64.36.115
- Last updated: 2026-10-06

## Ownership

- Organization: Jacobus De Beer
- Network name: 102.64.36.0 - 102.64.36.255
- Allocated block: 102.64.36.0/24
- ASN: AS327991 (https://ipdebrief.com/asn/327991)
- Regional registry: AFRINIC

## Location

- City: Vanderbijlpark
- Region: Gauteng
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (15/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ms-36-115.megasurf.co.za
- Forward-confirmed: yes

## Analyst narrative

\# IPDEBRIEF THREAT INTELLIGENCE BRIEFING

**Target:** 102.64.36.115/32

**Classification:** Moderate Risk / Observational Interest

**Report Date:** 2026-07-18

\---

\## EXECUTIVE SUMMARY

IP address 102.64.36.115 presents a moderate risk profile (risk score: 40) with geographic inconsistencies between reported location and network registration. The IP resolves to a South African Megasurf infrastructure hostname but is geolocated to Colombia. Limited service exposure (firewalled/no services) reduces active threat potential, though the IP appears on two DNSBL lists with high-severity ratings.

\---

\## NETWORK PROFILE

| Attribute | Value |

|-----------|-------|

| **IP Address** | 102.64.36.115/32 |

| **Risk Score** | 40 (Moderate) |

| **ASN** | 327991 |

| **Organization** | Megasurf Wireless Internet CC - Megasurf Wireless Internet CC, ZA |

| **Country (Reported)** | CO (Colombia) |

| **Country (ASN)** | ZA (South Africa) |

| **BGP Prefix** | 102.64.32.0/21 |

| **Hostname** | ms-36-115.megasurf.co.za |

| **DNSSEC** | Valid |

| **Service Status** | Firewalled / No Services |

| **Tor Exit Node** | No |

| **Known Attacker** | No |

| **Spam Source** | No |

| **DNSBL Listings** | 2 of 8 total lists |

\---

\## OBSERVATION HISTORY

**Total Observations:** 13

Key historical signals:

\- **Abuse Density:** 0.0889 (subnet 102.64.36.115/24)

\- **Subnet Classification:** mostly_clean

\- **Inherited Risk:** 3

\- **Total Siblings:** 90

\- **Active Siblings:** 25

\- **Threat Siblings:** 8

Recent observations indicate the IP remains within acceptable thresholds for residential/hosting infrastructure. No escalating threat patterns observed in signal history.

\---

\## SUBNET NEIGHBORHOOD ANALYSIS

**Subnet:** 102.64.36.115/24

| Metric | Value |

|--------|-------|

| Neighbor Count | 89 |

| Abuse Density | 0.011 |

| High-Risk Neighbors | 1 |

| Medium-Risk Neighbors | 50 |

| Low-Risk Neighbors | 18 |

**Notable Neighbors:**

\- 102.64.36.8 (Risk: 55)

\- 102.64.36.6 (Risk: 40)

The subnet exhibits mixed risk characteristics with elevated medium-risk neighbor concentration. One high-risk sibling requires monitoring.

\---

\## RELATIONSHIP MAPPING

| Type | Target |

|------|--------|

| DNS Association | ms-36-115.megasurf.co.za |

No organizational, certificate, or additional IP relationships identified.

\---

\## THREAT INDICATORS

\- **Blacklist Status:** Listed on 2 of 8 DNSBL feeds

\- **Maximum Severity:** High

\- **Campaign Correlation:** None identified

\- **C2 Behavior:** None observed

\- **Malware Distribution:** None detected

\---

\## RECOMMENDED ACTIONS

**Current Risk Level:** Moderate (Score: 40)

**Firewall Rules:**

\`\`\`bash

\# iptables

iptables -A INPUT -s 102.64.36.115 -j DROP

\# nftables

nft add rule inet filter input ip saddr 102.64.36.115 drop

\# Cloudflare WAF

ip.src eq 102.64.36.115 → BLOCK

\# AWS WAF

Addresses: 102.64.36.115/32 → BLOCK

\`\`\`

**Operational Recommendations:**

1. Monitor for traffic patterns consistent with the subnet's high-risk neighbor (102.64.36.8)

2. Verify geographic routing consistency given CO/Z A discrepancy

3. Review DNSBL listings for context (2/8 lists with high severity)

4. Consider subnet-level blocking if 102.64.36.0/24 deployment warrants

\---

\## ANALYST NOTES

This IP demonstrates infrastructure-level characteristics typical of residential internet service provider endpoints. The moderate risk score warrants defensive monitoring rather than immediate blocking. Geographic mismatch between reported location (Colombia) and ASN registration (South Africa) suggests potential routing anomalies or multi-ISP peering patterns. Recommend inclusion in threat intelligence feeds for ongoing observation.

## Nearby addresses

- 102.64.36.1 (https://ipdebrief.com/102.64.36.1)
- 102.64.36.3 (https://ipdebrief.com/102.64.36.3)
- 102.64.36.6 (https://ipdebrief.com/102.64.36.6)
- 102.64.36.7 (https://ipdebrief.com/102.64.36.7)
- 102.64.36.8 (https://ipdebrief.com/102.64.36.8)
- 102.64.36.9 (https://ipdebrief.com/102.64.36.9)
- 102.64.36.10 (https://ipdebrief.com/102.64.36.10)
- 102.64.36.12 (https://ipdebrief.com/102.64.36.12)
- 102.64.36.14 (https://ipdebrief.com/102.64.36.14)
- 102.64.36.15 (https://ipdebrief.com/102.64.36.15)
- 102.64.36.16 (https://ipdebrief.com/102.64.36.16)
- 102.64.36.17 (https://ipdebrief.com/102.64.36.17)

---

Source: IPDebrief, "102.64.36.115 IP intelligence", https://ipdebrief.com/102.64.36.115, updated 2026-10-06. Assessments are probabilistic.