102.64.42.249📋 Copy

IPDEBRIEF THREAT INTELLIGENCE BRIEFING

Target IP: 102.64.42.249/32

Generated: 2026-07-18

Risk Classification: HIGH (70/100)

---

**EXECUTIVE SUMMARY**

IP 102.64.42.249 presents a HIGH risk profile with an overall risk score of 70. The address belongs to the Jacobus De Beer organization (ASN 327991) under the Afrinic RIR. While the IP is not a known attacker, Tor exit, VPN, or proxy, it maintains 4 DNS blacklist listings and exhibits geolocation inconsistencies. The associated /24 subnet contains 88 sibling addresses with notable abuse density.

---

**OWNERSHIP & REGISTRATION**

• Organization: Jacobus De Beer
• ASN: 327991
• Netname: 102.64.42.0 - 102.64.42.255
• CIDR Block: 102.64.42.0/24
• RIR Registry: Afrinic

---

**GEOLOCATION ANALYSIS**

Geolocation data shows significant inconsistency across sources:

• Primary Resolution: South Africa (Vanderbijlpark, Gauteng) — coordinates: -26.7005, 27.8179
• Secondary Resolution: United Kingdom (London)
• Distance Discrepancy: 9,039 km between resolved locations
• Validity: GeoPlausible = true, but GeoConsensus = false

This geolocation divergence suggests potential misconfiguration or compromised routing information.

---

**NETWORK CLASSIFICATION**

• Services: Firewalled / No Services (No open ports detected)
• Infrastructure Type: Not CDN, Cloud, VPN, Tor, Proxy, or Hosting
• Mobile Carrier: None
• Bogon Status: False
• Anycast: False

---

**DNS & HOSTING INFORMATION**

• PTR Hostname: ms-42-249.megasurf.co.za
• DNS Resolution: Forward confirmed to megasurf.co.za domain
• Hosted Domains: None detected
• Email Authentication: SPF = true, DMARC = true

---

**THREAT INDICATORS**

• Known Campaigns: None
• Threat Feeds: None
• Blacklist Count: 4 out of 8 total lists
• Pulsedive Risk: Not available
• Abuse Confidence Score: Not reported
• Tor Exit Node: False
• Known Attacker: False

---

**SUBNET ANALYSIS (102.64.42.0/24)**

• Total Sibling IPs: 88
• Abuse Density: 0.011 (low-moderate)
• Risk Distribution:

- High Risk: 1 IP

- Medium Risk: 42 IPs

- Low Risk: 23 IPs

Notable High-Risk Neighbors:

• 102.64.42.13 (Risk Score: 70)
• 102.64.42.11 (Risk Score: 55)
• 102.64.42.4 (Risk Score: 40)

---

**OBSERVATION HISTORY**

• Total Observations: 17
• Ownership Stability: Stable (0 changes recorded)
• Threat Persistence: Not persistently malicious
• Recent Activity: No persistent malicious patterns observed

---

**CONTROL PLANE DATA**

• Origin ASN: 327991
• BGP Prefix: 102.64.40.0/21
• RPKI State: Not validated
• Route Stability: Unstable
• DNSSEC: Valid
• RRP Consistency: Not available

---

**RECOMMENDED ACTIONS**

Immediate:

1. Increase logging verbosity for traffic from this IP

2. Review recent activity logs for this address

Mitigation Controls:

• iptables: `iptables -A INPUT -s 102.64.42.249 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 102.64.42.249 drop`
• Cloudflare WAF: Block IP with filter expression `ip.src eq 102.64.42.249`
• AWS WAF: Add 102.64.42.249/32 to blocked addresses list

---

**INTELLIGENCE NOTES**

This IP operates with elevated risk despite lacking active exploit signatures. The 4 DNS blacklist listings combined with the high-risk classification and unstable BGP routing suggest potential reputation degradation. Monitoring the /24 subnet is recommended given the concentration of medium-risk addresses and the presence of 102.64.42.13, which shares an identical risk score (70).

---

Classification: DEFENSIVE SECURITY INTELLIGENCE

Source: IPDebrief Platform

Analysis Period: 2026-07-18

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.