102.64.38.154📋 Copy

# IP Intelligence Briefing: 102.64.38.154/32

## Executive Summary

IP address 102.64.38.154 presents a Moderate Risk profile (Risk Score: 55) with no active threat indicators but notable DNSBL listings. The IP is associated with organization Jacobus De Beer, registered under Afrinic RIR. Recent observation history indicates inconsistent geolocation reporting (GB/ZA) and three DNSBL listings with high severity ratings. The subnet exhibits low abuse density (0.02) with minimal high-risk neighbors.

## Profile Analysis

• Risk Score: 55 (Moderate Risk)
• Provider/Authority Scores: 0 (not a provider/authority IP)
• Network Classification: Residential/Infrastructure endpoint
• Service Status: Firewalled / No Services detected
• Network Role: No identified hosting, CDN, or proxy services

Ownership Details:

• ASN: 327991
• Organization: Jacobus De Beer
• CIDR Block: 102.64.38.0 - 102.64.38.255 (/24)
• RIR Registry: Afrinic

## Geolocation & DNS Intelligence

Primary Geolocation:

• Country: GB (United Kingdom)
• City: London
• Timezone: Europe/London
• Geo-Consensus: True (1 source)

DNS Resolution:

• PTR Hostname: ms-38-154.megasurf.co.za
• Forward Resolution: Confirmed
• Forward Hostnames: ms-38-154.megasurf.co.za
• Domain: .co.za (South African TLD - geographic discrepancy noted)

## Threat Indicators

• Known Campaigns: None identified
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• DNSBL Status: Listed on 3 of 8 total blacklists

## Control Plane Assessment

• BGP Prefix: 102.64.32.0/21
• Origin ASN: 327991
• Route Stability: False (unstable routing)
• RPKI State: Not validated
• IRR Consistency: Not validated
• Operator Score: 0.2609 (Basic)

## Observation History (13 Recent Signals)

Recent observations from 2026-07-30 reveal:

• Geolocation Conflict: One signal reports ZA (Vanderbijlpark, ZA) while primary profile shows GB (London)
• DNSBL Activity: One signal indicates high-severity DNSBL listings (3 total)
• Ownership Stability: No ownership changes detected
• Threat Persistence: 0 days of persistent malicious activity

## Neighborhood Analysis (Subnet: 102.64.38.0/24)

• Total Siblings: 49 IPs
• Risk Distribution: 1 High-risk, 29 Medium-risk, 15 Low-risk
• Abuse Density: 0.02 (2%)
• Notable Neighbors:

- 102.64.38.11: Risk 40, Authority 60

- 102.64.38.25: Risk 40, Authority 60

- 102.64.38.30: Risk 40, Authority 60

- 102.64.38.37: Risk 40, Authority 60

## Relationships

• Same Network: 102.64.38.0 - 102.64.38.255
• DNS Association: ms-38-154.megasurf.co.za (repeated in relationship graph)

## Security Recommendations

Based on the moderate risk profile and DNSBL listings, implement the following:

1. Monitor: Track the IP for changes in threat indicators and DNSBL status

2. Rate Limit: Apply rate limiting if traffic originates from this IP

3. Geo-Validation: Investigate geolocation discrepancy between reported GB and ZA locations

4. Block if Necessary: Consider blocking if DNSBL listings are confirmed as spam/abuse sources

5. Log Analysis: Monitor for unusual traffic patterns given the firewalled/no-services status

## Conclusion

IP 102.64.38.154 is a residential/infrastructure endpoint with moderate risk characteristics. The primary concerns are DNSBL listings (3/8 lists) and geolocation inconsistencies. No active threat campaigns or known attacker indicators were detected. The subnet demonstrates low abuse density, suggesting this is an isolated incident rather than part of a coordinated attack infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.