102.64.45.117📋 Copy

## IP INTELLIGENCE BRIEFING: 102.64.45.117/32

Date: Current

Classification: Moderate Risk (Score: 55/100)

---

Executive Summary

IP address 102.64.45.117 presents moderate risk with a reputation score of 55/100. The IP is associated with African Network Information Center (AS327991) and has been observed in Vanderbijlpark, Gauteng region. While currently showing no active open ports, the IP has been listed on 3 of 8 DNS blacklists and demonstrates geolocation inconsistencies between probe data sources.

---

Technical Profile

• IP Address: 102.64.45.117/32
• Control Plane: BGP prefix 102.64.40.0/21, Origin ASN 327991
• Geolocation: Primary reports Colombia (CO); historical data indicates South Africa (ZA), Vanderbijlpark, Gauteng
• Network Classification: Firewalled / No Services detected; no open ports
• DNS Resolution: ms-45-117.megasurf.co.za (forward confirmed)
• Email Authentication: SPF and DMARC records present
• Routing: 22-hop traceroute via Comcast transit network
• RPKI State: Inconsistent; route stability flagged as false

---

Threat Indicators

• DNSBL Listings: 3 of 8 total blacklists
• Known Campaigns: None correlated
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence Score: Not calculated

---

Observational History (14 Total Signals)

Recent activity (July 21, 2026) shows:

• DNS Listings: 8 total listings, 2 currently active (medium severity)
• Geolocation Signals: Consistent Vanderbijlpark, South Africa reporting
• ASN Attribution: AS327991 (African Network Information Center)
• Signal Confidence: Variable (0.07–0.85)
• Threat Persistence: 0 days observed

---

Subnet Analysis (102.64.45.0/24)

• Total Neighbors: 100 IPs
• Abuse Density: 0.01 (1%)
• Risk Distribution: 1 high-risk, 64 medium-risk, 9 low-risk siblings
• Notable Neighbors:

- 102.64.45.3 (Risk: 55, Authority: 60)

- 102.64.45.5 (Risk: 40, Authority: 60)

- 102.64.45.7 (Risk: 40, Authority: 60)

---

Relationships

• DNS Associations: ms-45-117.megasurf.co.za (primary hostname)
• No organization or subnet relationships identified
• No certificate associations

---

Recommended Actions

Priority: High

1. Monitoring: Increase logging verbosity and review recent activity from this IP

2. Firewall Rules:

- iptables: `iptables -A INPUT -s 102.64.45.117 -j DROP`

- nftables: `nft add rule inet filter input ip saddr 102.64.45.117 drop`

- nginx: `deny 102.64.45.117;`

- Cloudflare WAF: Block with description "IPDebrief risk score 55"

- AWS WAF: Add to blocklist with CIDR 102.64.45.117/32

3. Subnet Consideration: Monitor entire /24 subnet (102.64.45.0/24) due to elevated abuse density (1%) and multiple medium-to-high risk neighbors

---

Intelligence Assessment

The IP exhibits moderate risk characteristics with DNS blacklist associations and geolocation inconsistencies. While currently passive (no open services), the subnet environment suggests elevated abuse potential. Recommend defensive blocking with enhanced monitoring, particularly for organizations receiving inbound connections from this address range.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.