102.64.35.29📋 Copy

IP INTELLIGENCE BRIEFING: 102.64.35.29

Executive Summary

IP 102.64.35.29 presents a moderate risk profile (score: 55/100) with no active open services. The address is classified as "Firewalled / No Services" and is associated with MegaSurf infrastructure in Vanderbijlpark, Gauteng, South Africa. No known threat campaigns or active attack patterns detected.

Ownership & Infrastructure

• ASN: 327991
• Organization: Jacobus De Beer
• Network: 102.64.35.0/24 (102.64.35.0 - 102.64.35.255)
• Geolocation: South Africa (ZA), Gauteng, Vanderbijlpark
• DNS Hostname: ms-35-29.megasurf.co.za
• Classification: Residential ISP infrastructure

Threat Indicators

• DNSBL Listings: 3 of 8 total lists (high severity listings detected)
• Abuse Confidence: Not scored
• Campaign Association: None identified
• Known Attacker/SpamSource/Tor: No matches

Subnet Context

The /24 neighborhood (102.64.35.0/24) shows an abuse density of 0.04 (4%). Risk distribution across 100 sibling IPs: 4 high-risk, 75 medium-risk, 15 low-risk. Notable neighbor: 102.64.35.7 (risk score: 55). Subnet classification: "mostly_clean" with abuse density 0.1154.

Observation History

17 total observations recorded. Most recent signals (2026-07-30) indicate:

• Subnet abuse density: 0.1154
• Classification: "mostly_clean"
• Ownership changes: 0
• Threat persistence days: 0
• DNSBL listings confirmed with maximum severity: "high"

Behavioral Analysis

• No open ports or active services detected
• No TLS certificates or HTTP banners
• Not identified as hosting, CDN, VPN, proxy, or residential proxy
• Traceroute: 20 hops, transit via Comcast

Recommended Actions

Immediate:

• Increase logging verbosity and review recent activity from this IP
• Implement blocking rules across perimeter infrastructure

Firewall Rules:

```

iptables: iptables -A INPUT -s 102.64.35.29 -j DROP

nftables: nft add rule inet filter input ip saddr 102.64.35.29 drop

nginx: deny 102.64.35.29;

pfSense: 102.64.35.29/32

Cloudflare WAF: {"description":"Block 102.64.35.29 — IPDebrief risk score 55","action":"block","filter":{"expression":"ip.src eq 102.64.35.29"}}

AWS WAF: {"Addresses":["102.64.35.29/32"],"Description":"IPDebrief risk 55"}

```

Intelligence Assessment

The IP demonstrates moderate risk primarily due to DNSBL listings. No evidence of active exploitation or malicious behavior. Subnet-level analysis indicates a residential ISP environment with mixed risk profiles. Monitoring is recommended given the elevated risk score and blacklist associations.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.