102.64.43.111📋 Copy

# IP Intelligence Briefing: 102.64.43.111/32

Classification: Moderate Risk

Date: 2026-07-18

Prepared For: SOC Analysts

---

## Executive Summary

IP address 102.64.43.111 presents a moderate risk profile (score: 40) with no active threat indicators. The endpoint shows geolocation inconsistencies between reported sources and exhibits no open services or active scanning behavior. While the subnet demonstrates elevated abuse density, this specific IP is not currently flagged as malicious.

---

## Ownership & Registration

• ASN: 327991
• Organization: Jacobus De Beer
• Network Block: 102.64.43.0/24 (CIDR: 102.64.43.111/32)
• RIR: AFRINIC
• Abuse Contact: Not listed
• Registration Status: Active

---

## Geolocation Analysis

Primary Classification: GB (London)

Observed Discrepancy: Multiple history observations report South Africa (Vanderbijlpark, Gauteng)

• Profile Source: Europe/London timezone
• Historical Observations:

- 2026-07-18 14:17:26: South Africa (Vanderbijlpark, Gauteng) via MaxMind GeoLite2

- 2026-07-18 14:20:56: Johannesburg region (claimed lat: -26.7005, lon: 27.8179)

• RTT Analysis: 260ms average, 270ms maximum
• Validation: Geo-plausibility flag inconsistent across sources
• Geographic Consensus: False

The geographic mismatch suggests either misconfigured routing, CDN usage, or spoofed geolocation data.

---

## Network Services & DNS

• Open Ports: None detected
• Service Classification: Firewalled / No Services
• PTR Record: ms-43-111.megasurf.co.za
• Forward Resolution: Confirmed to ms-43-111.megasurf.co.za (co.za TLD)
• Email Authentication: SPF and DMARC records present
• HTTP Services: None active

The endpoint appears to be passively firewalled with no publicly exposed services.

---

## Threat Indicators

No active threat feeds or known campaigns associated with this IP.

---

## Subnet Context (102.64.43.0/24)

• Neighbor Count: 89 IPs in /24
• Abuse Density: 0
• Risk Distribution:

- High Risk: 0

- Medium Risk: 48

- Low Risk: 25

• Subnet Classification: Inherited Risk: 0

The subnet exhibits moderate activity with nearly half the addresses showing medium risk scores. Notable neighbors include:

• 102.64.43.1 (Risk: 55)
• 102.64.43.6 (Risk: 40)
• 102.64.43.9 (Risk: 55)
• 102.64.43.17 (Risk: 55)

---

## Historical Observations

Total observations: 17

• Ownership Changes: 0
• Threat Observation Count: 0
• Persistently Malicious: No
• Recent Signal Types:

- RTT/Geo validation (confidence: 0.90)

- Ownership verification (confidence: 0.85)

- Network classification (confidence: 0.30)

- Geolocation via MaxMind (confidence: 0.70)

- RIR registration data (confidence: 0.95)

The IP has demonstrated stability with no ownership changes or persistent threat behavior.

---

## Network Relationships

• DNS Associations: ms-43-111.megasurf.co.za (repeated across multiple records)
• Network Relationships: 102.64.43.0 - 102.64.43.255 (same network)
• Related Certificates: None
• Correlated IPs: None identified

---

## Recommended Actions

Based on the risk profile (score: 40), consider the following defensive measures:

Firewall Rules (Recommended)

```bash

# iptables

iptables -A INPUT -s 102.64.43.111 -j DROP

# nftables

nft add rule inet filter input ip saddr 102.64.43.111 drop

```

WAF/Cloud Rules

```nginx

# Nginx

deny 102.64.43.111;

# Cloudflare WAF

Block 102.64.43.111 — IPDebrief risk score 40

Expression: ip.src eq 102.64.43.111

# AWS WAF

Addresses: ["102.64.43.111/32"]

Description: IPDebrief risk 40

```

---

## Intelligence Assessment

1. Risk Level: Moderate (40/100) — No immediate threat, but subnet context warrants monitoring

2. Geographic Discrepancy: Investigate routing/CDN configuration vs. reported locations

3. Subnet Risk: 48/89 neighbors show medium risk; consider broader subnet-level controls

4. Service Status: No open services detected — endpoint appears to be passively defended

5. Threat Status: Clean — No active attack indicators, blacklists, or campaigns

Recommendation: Monitor subnet 102.64.43.0/24 for coordinated activity. Apply defensive rules at network perimeter while awaiting additional intelligence. No immediate containment required for this specific IP.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.