# 102.64.45.117 — IP Intelligence Summary

102.64.45.117 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-45-117.megasurf.co.za. As of October 7, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/102.64.45.117
- Last updated: 2026-10-07

## Ownership

- Organization: Jacobus De Beer
- Network name: 102.64.45.0 - 102.64.45.255
- Allocated block: 102.64.45.0/24
- ASN: AS327991 (https://ipdebrief.com/asn/327991)
- Regional registry: AFRINIC

## Location

- City: Vanderbijlpark
- Region: Gauteng
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ms-45-117.megasurf.co.za
- Forward-confirmed: yes

## Analyst narrative

\## IP INTELLIGENCE BRIEFING: 102.64.45.117/32

**Date:** Current

**Classification:** Moderate Risk (Score: 55/100)

\---

\### Executive Summary

IP address 102.64.45.117 presents moderate risk with a reputation score of 55/100. The IP is associated with African Network Information Center (AS327991) and has been observed in Vanderbijlpark, Gauteng region. While currently showing no active open ports, the IP has been listed on 3 of 8 DNS blacklists and demonstrates geolocation inconsistencies between probe data sources.

\---

\### Technical Profile

\- **IP Address:** 102.64.45.117/32

\- **Control Plane:** BGP prefix 102.64.40.0/21, Origin ASN 327991

\- **Geolocation:** Primary reports Colombia (CO); historical data indicates South Africa (ZA), Vanderbijlpark, Gauteng

\- **Network Classification:** Firewalled / No Services detected; no open ports

\- **DNS Resolution:** ms-45-117.megasurf.co.za (forward confirmed)

\- **Email Authentication:** SPF and DMARC records present

\- **Routing:** 22-hop traceroute via Comcast transit network

\- **RPKI State:** Inconsistent; route stability flagged as false

\---

\### Threat Indicators

\- **DNSBL Listings:** 3 of 8 total blacklists

\- **Known Campaigns:** None correlated

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Abuse Confidence Score:** Not calculated

\---

\### Observational History (14 Total Signals)

Recent activity (July 21, 2026) shows:

\- **DNS Listings:** 8 total listings, 2 currently active (medium severity)

\- **Geolocation Signals:** Consistent Vanderbijlpark, South Africa reporting

\- **ASN Attribution:** AS327991 (African Network Information Center)

\- **Signal Confidence:** Variable (0.07–0.85)

\- **Threat Persistence:** 0 days observed

\---

\### Subnet Analysis (102.64.45.0/24)

\- **Total Neighbors:** 100 IPs

\- **Abuse Density:** 0.01 (1%)

\- **Risk Distribution:** 1 high-risk, 64 medium-risk, 9 low-risk siblings

\- **Notable Neighbors:**

\- 102.64.45.3 (Risk: 55, Authority: 60)

\- 102.64.45.5 (Risk: 40, Authority: 60)

\- 102.64.45.7 (Risk: 40, Authority: 60)

\---

\### Relationships

\- **DNS Associations:** ms-45-117.megasurf.co.za (primary hostname)

\- **No organization or subnet relationships identified**

\- **No certificate associations**

\---

\### Recommended Actions

**Priority:** High

1. **Monitoring:** Increase logging verbosity and review recent activity from this IP

2. **Firewall Rules:**

\- iptables: \`iptables -A INPUT -s 102.64.45.117 -j DROP\`

\- nftables: \`nft add rule inet filter input ip saddr 102.64.45.117 drop\`

\- nginx: \`deny 102.64.45.117;\`

\- Cloudflare WAF: Block with description "IPDebrief risk score 55"

\- AWS WAF: Add to blocklist with CIDR 102.64.45.117/32

3. **Subnet Consideration:** Monitor entire /24 subnet (102.64.45.0/24) due to elevated abuse density (1%) and multiple medium-to-high risk neighbors

\---

\### Intelligence Assessment

The IP exhibits moderate risk characteristics with DNS blacklist associations and geolocation inconsistencies. While currently passive (no open services), the subnet environment suggests elevated abuse potential. Recommend defensive blocking with enhanced monitoring, particularly for organizations receiving inbound connections from this address range.

## Nearby addresses

- 102.64.45.1 (https://ipdebrief.com/102.64.45.1)
- 102.64.45.3 (https://ipdebrief.com/102.64.45.3)
- 102.64.45.4 (https://ipdebrief.com/102.64.45.4)
- 102.64.45.5 (https://ipdebrief.com/102.64.45.5)
- 102.64.45.7 (https://ipdebrief.com/102.64.45.7)
- 102.64.45.9 (https://ipdebrief.com/102.64.45.9)
- 102.64.45.11 (https://ipdebrief.com/102.64.45.11)
- 102.64.45.12 (https://ipdebrief.com/102.64.45.12)
- 102.64.45.15 (https://ipdebrief.com/102.64.45.15)
- 102.64.45.18 (https://ipdebrief.com/102.64.45.18)
- 102.64.45.19 (https://ipdebrief.com/102.64.45.19)
- 102.64.45.22 (https://ipdebrief.com/102.64.45.22)

---

Source: IPDebrief, "102.64.45.117 IP intelligence", https://ipdebrief.com/102.64.45.117, updated 2026-10-07. Assessments are probabilistic.