102.64.35.189📋 Copy

## IP Intelligence Briefing: 102.64.35.189

Classification: Moderate Risk (55/100)

Date: 2026-07-30

Analysis Scope: Full profile, history, relationships, and neighborhood assessment

---

Executive Summary

IP 102.64.35.189 is a South African endpoint in the Vanderbijlpark region under Jacobus De Beer (ASN 327991). The IP is firewalled with no open services detected, reverse-resolves to megasurf.co.za, and shows no active threat indicators. Risk score of 55/100 indicates moderate risk requiring enhanced monitoring.

---

Network Intelligence

Ownership & Registration

• Organization: Jacobus De Beer
• ASN: 327991
• CIDR Block: 102.64.35.0/24
• RIR: AfriNIC
• Abuse Contact: None listed

Geolocation

• Country: South Africa (ZA)
• Region: Gauteng
• City: Vanderbijlpark
• Accuracy Radius: 800km
• Geo Validation: Inconsistent signals (geoPlausible: false)

Network Role Classification

• No active services detected (Firewalled / No Services)
• Not a CDN, proxy, VPN, Tor exit, or hosting provider
• DNSSEC: Valid

---

Threat Indicators

Current Threat Status

• Risk Score: 55/100 (Moderate)
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane Signals

• DNSBL Listed: 3 of 8 total lists
• Operator Score: 0.2609 (Basic)
• Route Stability: Unstable (false)
• BGP Prefix: 102.64.32.0/21

Email Reputation

• SPF: Present
• DMARC: Present
• TXT Record Count: 0

---

Historical Observation

Observation Count: 14 signals recorded

Most Recent: 2026-07-30T22:01:57 UTC

Key Historical Signals

• Geo-location inference: South Africa (52% confidence, 800km accuracy)
• Network classification: No services detected (30% confidence)
• Operator assessment: Basic (60% confidence)
• No persistent malicious activity observed
• No ownership changes recorded

---

Relationship Analysis

Network Associations: 102.64.35.0 - 102.64.35.255

DNS Associations: ms-35-189.megasurf.co.za (reverse DNS)

Total Relationships: 8 (6 network, 2 DNS)

---

Neighborhood Assessment (102.64.35.0/24)

Subnet Overview

• Total Neighbors: 100
• Abuse Density: 6% (0.06)
• Risk Distribution: High (6), Medium (76), Low (16)

Notable Neighbor Risk Scores:

• 102.64.35.7: Risk 55
• 102.64.35.3, 102.64.35.5, 102.64.35.12: Risk 40
• 102.64.35.14: Risk 30

---

Recommended Actions

Monitoring

• Increase logging verbosity for traffic from this IP
• Review recent activity and connection patterns

Firewall Rules

• `iptables`: `iptables -A INPUT -s 102.64.35.189 -j DROP`
• `nftables`: `nft add rule inet filter input ip saddr 102.64.35.189 drop`
• `nginx`: `deny 102.64.35.189;`
• `pfSense`: Add `102.64.35.189/32` to block list
• `Cloudflare WAF`: Block IP 102.64.35.189
• `AWS WAF`: Add 102.64.35.189/32 to blocked addresses

Context

Recommendations are probabilistic and should be combined with additional threat intelligence signals before implementing blocking rules.

---

Intelligence Source: IPDebrief

Status: Complete Analysis

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.