# 102.64.43.111 — IP Intelligence Summary 102.64.43.111 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to London, United Kingdom. Its reverse DNS name is ms-43-111.megasurf.co.za. As of October 6, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/102.64.43.111 - Last updated: 2026-10-06 ## Ownership - Organization: Jacobus De Beer - Network name: 102.64.43.0 - 102.64.43.255 - Allocated block: 102.64.43.0/24 - ASN: AS327991 (https://ipdebrief.com/asn/327991) - Regional registry: AFRINIC ## Location - City: London - Region: Gauteng - Country: United Kingdom - Time zone: Europe/London ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (55/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - ms-43-111.megasurf.co.za - Forward-confirmed: yes ## Analyst narrative \# IP Intelligence Briefing: 102.64.43.111/32 **Classification:** Moderate Risk **Date:** 2026-07-18 **Prepared For:** SOC Analysts \--- \## Executive Summary IP address 102.64.43.111 presents a moderate risk profile (score: 40) with no active threat indicators. The endpoint shows geolocation inconsistencies between reported sources and exhibits no open services or active scanning behavior. While the subnet demonstrates elevated abuse density, this specific IP is not currently flagged as malicious. \--- \## Ownership & Registration \- **ASN:** 327991 \- **Organization:** Jacobus De Beer \- **Network Block:** 102.64.43.0/24 (CIDR: 102.64.43.111/32) \- **RIR:** AFRINIC \- **Abuse Contact:** Not listed \- **Registration Status:** Active \--- \## Geolocation Analysis **Primary Classification:** GB (London) **Observed Discrepancy:** Multiple history observations report South Africa (Vanderbijlpark, Gauteng) \- **Profile Source:** Europe/London timezone \- **Historical Observations:** \- 2026-07-18 14:17:26: South Africa (Vanderbijlpark, Gauteng) via MaxMind GeoLite2 \- 2026-07-18 14:20:56: Johannesburg region (claimed lat: -26.7005, lon: 27.8179) \- **RTT Analysis:** 260ms average, 270ms maximum \- **Validation:** Geo-plausibility flag inconsistent across sources \- **Geographic Consensus:** False The geographic mismatch suggests either misconfigured routing, CDN usage, or spoofed geolocation data. \--- \## Network Services & DNS \- **Open Ports:** None detected \- **Service Classification:** Firewalled / No Services \- **PTR Record:** ms-43-111.megasurf.co.za \- **Forward Resolution:** Confirmed to ms-43-111.megasurf.co.za (co.za TLD) \- **Email Authentication:** SPF and DMARC records present \- **HTTP Services:** None active The endpoint appears to be passively firewalled with no publicly exposed services. \--- \## Threat Indicators | Indicator | Status | |-----------|--------| | Known Attacker | No | | Spam Source | No | | Tor Exit Node | No | | Proxy/VPN | No | | Mobile/Residential | No | | DNSBL Listings | 2 of 8 total lists | | Blacklist Count | 0 | | Threat Persistence Days | 0 | No active threat feeds or known campaigns associated with this IP. \--- \## Subnet Context (102.64.43.0/24) \- **Neighbor Count:** 89 IPs in /24 \- **Abuse Density:** 0 \- **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 48 \- Low Risk: 25 \- **Subnet Classification:** Inherited Risk: 0 The subnet exhibits moderate activity with nearly half the addresses showing medium risk scores. Notable neighbors include: \- 102.64.43.1 (Risk: 55) \- 102.64.43.6 (Risk: 40) \- 102.64.43.9 (Risk: 55) \- 102.64.43.17 (Risk: 55) \--- \## Historical Observations Total observations: 17 \- **Ownership Changes:** 0 \- **Threat Observation Count:** 0 \- **Persistently Malicious:** No \- **Recent Signal Types:** \- RTT/Geo validation (confidence: 0.90) \- Ownership verification (confidence: 0.85) \- Network classification (confidence: 0.30) \- Geolocation via MaxMind (confidence: 0.70) \- RIR registration data (confidence: 0.95) The IP has demonstrated stability with no ownership changes or persistent threat behavior. \--- \## Network Relationships \- **DNS Associations:** ms-43-111.megasurf.co.za (repeated across multiple records) \- **Network Relationships:** 102.64.43.0 - 102.64.43.255 (same network) \- **Related Certificates:** None \- **Correlated IPs:** None identified \--- \## Recommended Actions Based on the risk profile (score: 40), consider the following defensive measures: \### Firewall Rules (Recommended) \`\`\`bash \# iptables iptables -A INPUT -s 102.64.43.111 -j DROP \# nftables nft add rule inet filter input ip saddr 102.64.43.111 drop \`\`\` \### WAF/Cloud Rules \`\`\`nginx \# Nginx deny 102.64.43.111; \# Cloudflare WAF Block 102.64.43.111 — IPDebrief risk score 40 Expression: ip.src eq 102.64.43.111 \# AWS WAF Addresses: \["102.64.43.111/32"\] Description: IPDebrief risk 40 \`\`\` \--- \## Intelligence Assessment 1. **Risk Level:** Moderate (40/100) — No immediate threat, but subnet context warrants monitoring 2. **Geographic Discrepancy:** Investigate routing/CDN configuration vs. reported locations 3. **Subnet Risk:** 48/89 neighbors show medium risk; consider broader subnet-level controls 4. **Service Status:** No open services detected — endpoint appears to be passively defended 5. **Threat Status:** Clean — No active attack indicators, blacklists, or campaigns **Recommendation:** Monitor subnet 102.64.43.0/24 for coordinated activity. Apply defensive rules at network perimeter while awaiting additional intelligence. No immediate containment required for this specific IP. ## Nearby addresses - 102.64.43.1 (https://ipdebrief.com/102.64.43.1) - 102.64.43.3 (https://ipdebrief.com/102.64.43.3) - 102.64.43.6 (https://ipdebrief.com/102.64.43.6) - 102.64.43.8 (https://ipdebrief.com/102.64.43.8) - 102.64.43.9 (https://ipdebrief.com/102.64.43.9) - 102.64.43.10 (https://ipdebrief.com/102.64.43.10) - 102.64.43.11 (https://ipdebrief.com/102.64.43.11) - 102.64.43.12 (https://ipdebrief.com/102.64.43.12) - 102.64.43.14 (https://ipdebrief.com/102.64.43.14) - 102.64.43.15 (https://ipdebrief.com/102.64.43.15) - 102.64.43.17 (https://ipdebrief.com/102.64.43.17) - 102.64.43.18 (https://ipdebrief.com/102.64.43.18) --- Source: IPDebrief, "102.64.43.111 IP intelligence", https://ipdebrief.com/102.64.43.111, updated 2026-10-06. Assessments are probabilistic.