# 102.64.42.249 — IP Intelligence Summary 102.64.42.249 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to London, United Kingdom. Its reverse DNS name is ms-42-249.megasurf.co.za. As of October 6, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/102.64.42.249 - Last updated: 2026-10-06 ## Ownership - Organization: Jacobus De Beer - Network name: 102.64.42.0 - 102.64.42.255 - Allocated block: 102.64.42.0/24 - ASN: AS327991 (https://ipdebrief.com/asn/327991) - Regional registry: AFRINIC ## Location - City: London - Region: Gauteng - Country: United Kingdom - Time zone: Europe/London ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (55/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - ms-42-249.megasurf.co.za - Forward-confirmed: yes ## Analyst narrative **IPDEBRIEF THREAT INTELLIGENCE BRIEFING** **Target IP:** 102.64.42.249/32 **Generated:** 2026-07-18 **Risk Classification:** HIGH (70/100) \--- \### **EXECUTIVE SUMMARY** IP 102.64.42.249 presents a HIGH risk profile with an overall risk score of 70. The address belongs to the Jacobus De Beer organization (ASN 327991) under the Afrinic RIR. While the IP is not a known attacker, Tor exit, VPN, or proxy, it maintains 4 DNS blacklist listings and exhibits geolocation inconsistencies. The associated /24 subnet contains 88 sibling addresses with notable abuse density. \--- \### **OWNERSHIP & REGISTRATION** \- **Organization:** Jacobus De Beer \- **ASN:** 327991 \- **Netname:** 102.64.42.0 - 102.64.42.255 \- **CIDR Block:** 102.64.42.0/24 \- **RIR Registry:** Afrinic \--- \### **GEOLOCATION ANALYSIS** Geolocation data shows significant inconsistency across sources: \- **Primary Resolution:** South Africa (Vanderbijlpark, Gauteng) — coordinates: -26.7005, 27.8179 \- **Secondary Resolution:** United Kingdom (London) \- **Distance Discrepancy:** 9,039 km between resolved locations \- **Validity:** GeoPlausible = true, but GeoConsensus = false This geolocation divergence suggests potential misconfiguration or compromised routing information. \--- \### **NETWORK CLASSIFICATION** \- **Services:** Firewalled / No Services (No open ports detected) \- **Infrastructure Type:** Not CDN, Cloud, VPN, Tor, Proxy, or Hosting \- **Mobile Carrier:** None \- **Bogon Status:** False \- **Anycast:** False \--- \### **DNS & HOSTING INFORMATION** \- **PTR Hostname:** ms-42-249.megasurf.co.za \- **DNS Resolution:** Forward confirmed to megasurf.co.za domain \- **Hosted Domains:** None detected \- **Email Authentication:** SPF = true, DMARC = true \--- \### **THREAT INDICATORS** \- **Known Campaigns:** None \- **Threat Feeds:** None \- **Blacklist Count:** 4 out of 8 total lists \- **Pulsedive Risk:** Not available \- **Abuse Confidence Score:** Not reported \- **Tor Exit Node:** False \- **Known Attacker:** False \--- \### **SUBNET ANALYSIS (102.64.42.0/24)** \- **Total Sibling IPs:** 88 \- **Abuse Density:** 0.011 (low-moderate) \- **Risk Distribution:** \- High Risk: 1 IP \- Medium Risk: 42 IPs \- Low Risk: 23 IPs **Notable High-Risk Neighbors:** \- 102.64.42.13 (Risk Score: 70) \- 102.64.42.11 (Risk Score: 55) \- 102.64.42.4 (Risk Score: 40) \--- \### **OBSERVATION HISTORY** \- **Total Observations:** 17 \- **Ownership Stability:** Stable (0 changes recorded) \- **Threat Persistence:** Not persistently malicious \- **Recent Activity:** No persistent malicious patterns observed \--- \### **CONTROL PLANE DATA** \- **Origin ASN:** 327991 \- **BGP Prefix:** 102.64.40.0/21 \- **RPKI State:** Not validated \- **Route Stability:** Unstable \- **DNSSEC:** Valid \- **RRP Consistency:** Not available \--- \### **RECOMMENDED ACTIONS** **Immediate:** 1. Increase logging verbosity for traffic from this IP 2. Review recent activity logs for this address **Mitigation Controls:** \- **iptables:** \`iptables -A INPUT -s 102.64.42.249 -j DROP\` \- **nftables:** \`nft add rule inet filter input ip saddr 102.64.42.249 drop\` \- **Cloudflare WAF:** Block IP with filter expression \`ip.src eq 102.64.42.249\` \- **AWS WAF:** Add 102.64.42.249/32 to blocked addresses list \--- \### **INTELLIGENCE NOTES** This IP operates with elevated risk despite lacking active exploit signatures. The 4 DNS blacklist listings combined with the high-risk classification and unstable BGP routing suggest potential reputation degradation. Monitoring the /24 subnet is recommended given the concentration of medium-risk addresses and the presence of 102.64.42.13, which shares an identical risk score (70). \--- **Classification:** DEFENSIVE SECURITY INTELLIGENCE **Source:** IPDebrief Platform **Analysis Period:** 2026-07-18 ## Nearby addresses - 102.64.42.1 (https://ipdebrief.com/102.64.42.1) - 102.64.42.2 (https://ipdebrief.com/102.64.42.2) - 102.64.42.3 (https://ipdebrief.com/102.64.42.3) - 102.64.42.4 (https://ipdebrief.com/102.64.42.4) - 102.64.42.5 (https://ipdebrief.com/102.64.42.5) - 102.64.42.9 (https://ipdebrief.com/102.64.42.9) - 102.64.42.11 (https://ipdebrief.com/102.64.42.11) - 102.64.42.12 (https://ipdebrief.com/102.64.42.12) - 102.64.42.13 (https://ipdebrief.com/102.64.42.13) - 102.64.42.15 (https://ipdebrief.com/102.64.42.15) - 102.64.42.16 (https://ipdebrief.com/102.64.42.16) - 102.64.42.17 (https://ipdebrief.com/102.64.42.17) --- Source: IPDebrief, "102.64.42.249 IP intelligence", https://ipdebrief.com/102.64.42.249, updated 2026-10-06. Assessments are probabilistic.