# 102.64.41.180 — IP Intelligence Summary

102.64.41.180 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-41-180.megasurf.co.za. As of October 7, 2026, IPDebrief rates it High Risk (80/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/102.64.41.180
- Last updated: 2026-10-07

## Ownership

- Organization: Jacobus De Beer
- Network name: 102.64.41.0 - 102.64.41.255
- Allocated block: 102.64.41.0/24
- ASN: AS327991 (https://ipdebrief.com/asn/327991)
- Regional registry: AFRINIC

## Location

- City: Vanderbijlpark
- Region: Gauteng
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (80/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ms-41-180.megasurf.co.za
- Forward-confirmed: yes

## Analyst narrative

\# IP INTELLIGENCE BRIEFING: 102.64.41.180/32

**Date**: 2026-07-19

**Classification**: Moderate Risk (55/100)

**Analyst**: IPDebrief Intelligence Team

\---

\## EXECUTIVE SUMMARY

IP address 102.64.41.180 registers as a moderate-risk endpoint with elevated monitoring priority. The address is associated with Jacobus De Beer under ASN 327991 (Megasurf Wireless Internet CC). Geographic attribution shows inconsistencies between registry data (South Africa) and geolocation probes (Colombia), requiring validation. The IP resolves to a South African domain (ms-41-180.megasurf.co.za) with SPF and DMARC records in place.

\---

\## OWNERSHIP AND NETWORK CLASSIFICATION

| Attribute | Value |

|-----------|-------|

| **Organization** | Jacobus De Beer |

| **ASN** | 327991 |

| **Network Block** | 102.64.41.0 - 102.64.41.255 (/24) |

| **RIR** | AFRINIC |

| **Registration Date** | 2019-06-12 |

| **Abuse Contact** | Not provided |

| **Risk Score** | 55/100 |

| **Abuse Confidence Score** | Not available |

\---

\## GEOGRAPHIC ATTRIBUTION ANALYSIS

**Primary Attribution**: South Africa (ZA)

**Geolocation Provider**: Multiple sources (geoSourceCount: 2)

**Consensus Status**: Inconsistent (geoConsensus: false)

**Plausibility**: Not plausible (geoPlausible: false)

**Discrepancy Note**: Registry data indicates South African origin, while geolocation probes suggest Colombia. This inconsistency warrants validation before assigning definitive geographic attribution.

\---

\## THREAT INDICATORS AND REPUTATION

| Indicator | Status |

|-----------|--------|

| **Blacklist Count** | 0 |

| **DNSBL Listings** | 3 of 8 total lists |

| **Known Attacker** | No |

| **Spam Source** | No |

| **Tor Exit Node** | No |

| **Known Campaigns** | None identified |

| **Campaign Likelihood** | Not established |

**Historical Observation**: 15 signal observations recorded. Recent observations (2026-07-19) show DNSSEC validation in place and consistent ASN attribution to Megasurf Wireless Internet CC.

\---

\## DNS AND SERVICE ANALYSIS

| Component | Details |

|-----------|---------|

| **PTR Hostname** | ms-41-180.megasurf.co.za |

| **Forward Resolution** | Confirmed |

| **Hosted Domains** | 0 |

| **Open Ports** | None detected |

| **TLS Certificate** | Not present |

| **Email Authentication** | SPF: Yes, DMARC: Yes |

| **SPF Record** | v=spf1 a:mail.coza.net.za a:mx2.coza.net.za a:mail.registry.net.za include:_spf.google.com ip4:206.223.136.0/24 ip4:196.29.56.0/22 ip4:192.29.59.0/24 ip6:2001:43f8:30::0/48 -all |

**Service Status**: Firewalled / No Services (no open ports, no HTTP/HTTPS activity detected)

\---

\## NETWORK NEIGHBORHOOD ANALYSIS

**Subnet**: 102.64.41.0/24

**Total Siblings**: 89

**Risk Distribution**:

\- High Risk: 0

\- Medium Risk: 45 (50.6%)

\- Low Risk: 22 (24.7%)

\- No Risk: 22 (24.7%)

**Abuse Density**: 0.0

**Inherited Risk**: 0

**Classification**: Not classified

**Notable Neighbors**: 102.64.41.6 (Risk Score: 55), 102.64.41.3, 102.64.41.8, 102.64.41.12 (all with risk scores of 0-55)

\---

\## RELATIONSHIP GRAPH

| Relationship Type | Target |

|-------------------|--------|

| Same Network | 102.64.41.0 - 102.64.41.255 |

| DNS Association | ms-41-180.megasurf.co.za |

| Same Network | 102.64.41.0 - 102.64.41.255 |

\---

\## CONTROL PLANE DATA

| Metric | Value |

|--------|-------|

| **Origin ASN** | 327991 |

| **BGP Prefix** | 102.64.40.0/21 |

| **RPKI State** | Not available |

| **IRR Consistency** | Not available |

| **Route Changes (30d)** | 0 |

| **Route Stability** | Unstable |

| **DNSSEC Valid** | Yes |

| **DNSBL Listed** | 3 of 8 lists |

\---

\## TRACEROUTE ANALYSIS

| Metric | Value |

|--------|-------|

| **Hop Count** | 30 |

| **First Hop RTT** | 0.3ms |

| **Last Hop RTT** | 251.9ms |

| **Timed Out Hops** | 21 |

| **Transit Networks** | Comcast |

\---

\## RECOMMENDED ACTIONS

\### Monitoring Recommendations

\- **Priority**: High

\- **Action**: Increase logging verbosity and review recent activity from this IP

\- **Rationale**: Elevated risk score (55/100) warrants enhanced visibility

\### Firewall Rules

The following rules are recommended based on risk profile:

**iptables**:

\`\`\`

iptables -A INPUT -s 102.64.41.180 -j DROP

\`\`\`

**nftables**:

\`\`\`

nft add rule inet filter input ip saddr 102.64.41.180 drop

\`\`\`

**nginx**:

\`\`\`

deny 102.64.41.180;

\`\`\`

**Cloudflare WAF**:

\`\`\`json

{

"description": "Block 102.64.41.180 — IPDebrief risk score 55",

"action": "block",

"filter": {

"expression": "ip.src eq 102.64.41.180"

}

}

\`\`\`

**AWS WAF**:

\`\`\`json

{

"Addresses": \["102.64.41.180/32"\],

"Description": "IPDebrief risk 55"

}

\`\`\`

\---

\## ANALYST NOTES

1. **Geographic Discrepancy**: The IP shows conflicting geographic attribution (South Africa registry vs. Colombia geolocation). This may indicate proxying, misconfiguration, or data quality issues.

2. **DNS Configuration**: Valid SPF and DMARC records are present for the associated domain, which is positive for email security posture.

3. **Route Stability**: Route changes show 0 modifications in the last 30 days, but route stability is marked as unstable, suggesting potential underlying BGP propagation issues.

4. **Email Security**: SPF and DMARC records are properly configured for the associated domain, indicating reasonable email authentication practices.

5. **No Active Services**: No open ports or HTTP/HTTPS services detected, suggesting this IP may be used for outbound traffic only or is heavily firewalled.

\---

\## THREAT ASSESSMENT SUMMARY

| Risk Factor | Assessment |

|-------------|------------|

| **Overall Risk** | Moderate (55/100) |

| **Malicious Activity** | Not observed |

| **Infrastructure Quality** | Stable infrastructure with proper DNSSEC |

| **Geographic Consistency** | Inconsistent attribution |

| **Reputation** | Mixed (3/8 DNSBL listings) |

**Threat Level**: LOW-MEDIUM

**Action Priority**: MONITOR

\---

\## FINAL RECOMMENDATIONS

1. **Block or Rate Limit**: Based on the risk score of 55/100 and elevated monitoring priority, consider blocking or implementing rate limiting for this IP at perimeter firewalls.

2. **Monitor for Escalation**: Given the moderate risk classification, implement enhanced logging for traffic from this IP and correlate with other threat intelligence feeds.

3. **Validate Geographic Discrepancy**: Investigate why geolocation data conflicts between registry (ZA) and probe data (CO) to determine if this indicates proxying, spoofing, or data quality issues.

4. **Review Neighbor IPs**: Several sibling IPs in the 102.64.41.0/24 block show risk scores of 55. Consider evaluating the entire subnet for consistent threat patterns.

5. **Update Threat Intelligence Feed**: Add this IP to your threat intelligence platform for ongoing monitoring and automated alerting on future activity.

\---

**END OF INTELLIGENCE BRIEFING**

*This briefing was generated using IPDebrief platform data as of 2026-07-19. All data is sourced from public threat intelligence feeds and network observation records.*

## Nearby addresses

- 102.64.41.3 (https://ipdebrief.com/102.64.41.3)
- 102.64.41.6 (https://ipdebrief.com/102.64.41.6)
- 102.64.41.8 (https://ipdebrief.com/102.64.41.8)
- 102.64.41.10 (https://ipdebrief.com/102.64.41.10)
- 102.64.41.11 (https://ipdebrief.com/102.64.41.11)
- 102.64.41.12 (https://ipdebrief.com/102.64.41.12)
- 102.64.41.13 (https://ipdebrief.com/102.64.41.13)
- 102.64.41.15 (https://ipdebrief.com/102.64.41.15)
- 102.64.41.16 (https://ipdebrief.com/102.64.41.16)
- 102.64.41.17 (https://ipdebrief.com/102.64.41.17)
- 102.64.41.19 (https://ipdebrief.com/102.64.41.19)
- 102.64.41.22 (https://ipdebrief.com/102.64.41.22)

---

Source: IPDebrief, "102.64.41.180 IP intelligence", https://ipdebrief.com/102.64.41.180, updated 2026-10-07. Assessments are probabilistic.