102.64.42.91📋 Copy

# IP INTELLIGENCE BRIEFING: 102.64.42.91/32

## Executive Summary

IP address 102.64.42.91 presents a Moderate Risk profile (Risk Score: 40). The IP is owned by Jacobus De Beer under ASN 327991 (Megasurf Wireless Internet CC) and is registered in South Africa. The IP is currently firewalled with no active services detected. While the IP itself shows no direct threat indicators, the associated /24 subnet exhibits moderate abuse density (0.1186) with 7 threat-identified siblings out of 59 total.

---

## Ownership & Geolocation

• Organization: Jacobus De Beer
• ASN: 327991 (Megasurf Wireless Internet CC)
• Country: South Africa (ZA)
• Region: Gauteng
• City: Vanderbijlpark
• CIDR Block: 102.64.42.0 - 102.64.42.255
• RIR: AFRINIC
• Registration Date: 2019-06-12
• Abuse Contact: Not provided

---

## Network Role & Services

• Status: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Not Classified As: Cloud, CDN, VPN, Proxy, Tor Exit, Hosting, Mobile, Residential
• Bogon: No
• Anycast: No

---

## DNS Analysis

• PTR Hostname: ms-42-91.megasurf.co.za
• Forward Resolution: Confirmed
• Domain: co.za
• Hosted Domains: 0
• DNSSEC Valid: Yes
• SPF: Present
• DMARC: Present

---

## Threat Indicators

• Abuse Confidence Score: Not available
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Known Campaigns: None detected
• Threat Feeds: None matched

---

## Control Plane & Routing

• Origin ASN: 327991
• BGP Prefix: 102.64.40.0/21
• Route Stability: False
• MOAS: No
• DNSBL Listed: 2 out of 8 total lists
• Operator Score: 0.2609 (Basic)
• RPKI State: Not available

---

## Neighborhood Analysis (/24 Subnet)

• Subnet: 102.64.42.0/24
• Abuse Density: 0.1186 (Low-Moderate)
• Classification: Mostly Clean
• Total Siblings: 59
• Active Siblings: 18
• Threat Siblings: 7
• Risk Distribution:

- High Risk: 4 IPs

- Medium Risk: 34 IPs

- Low Risk: 11 IPs

---

## Observation History

• Total Observations: 22 signals
• Recent Activity: Signals observed as recently as June 25, 2026
• ASN Consistency: Megasurf Wireless Internet CC (ZA) consistent across observations
• Geolocation Consistency: South Africa (ZA) consistent
• Subnet Abuse Density: Maintained at ~0.1186 across observations
• Threat Persistence: 0 days (not persistently malicious)
• Ownership Changes: 0

---

## Recommended Security Actions

Based on the risk profile, the following firewall rules are recommended:

```bash

# iptables

iptables -A INPUT -s 102.64.42.91 -j DROP

# nftables

nft add rule inet filter input ip saddr 102.64.42.91 drop

# nginx

deny 102.64.42.91;

# pfSense

102.64.42.91/32

# Cloudflare WAF

{

"description": "Block 102.64.42.91 — IPDebrief risk score 40",

"action": "block",

"filter": {

"expression": "ip.src eq 102.64.42.91"

}

}

# AWS WAF

{

"Addresses": ["102.64.42.91/32"],

"Description": "IPDebrief risk 40"

}

```

---

## Intelligence Assessment

This IP address represents a Moderate Risk endpoint from a South African wireless ISP. The lack of active services and firewalled status suggests the IP may be dormant, a residential endpoint, or recently provisioned. While the IP itself shows no direct threat indicators, the /24 subnet context indicates potential lateral risk—7 other IPs in the same subnet have been flagged as threats.

Recommended Action: Block at perimeter firewall level. Monitor for any service activation or outbound connection attempts. Correlate with any inbound connection attempts to determine if this IP is being used as an attack source or is merely a passive endpoint.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.