# 102.64.35.59 — IP Intelligence Summary

102.64.35.59 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-35-59.megasurf.co.za. As of October 7, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/102.64.35.59
- Last updated: 2026-10-07

## Ownership

- Organization: Jacobus De Beer
- Network name: 102.64.35.0 - 102.64.35.255
- Allocated block: 102.64.35.0/24
- ASN: AS327991 (https://ipdebrief.com/asn/327991)
- Regional registry: AFRINIC

## Location

- City: Vanderbijlpark
- Region: Gauteng
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (55/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ms-35-59.megasurf.co.za
- Forward-confirmed: yes

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target:** 102.64.35.59/32

**Classification:** Moderate Risk (Score: 40/100)

**Date:** Current Assessment

\---

\## Executive Summary

IP 102.64.35.59 is a South African (ZA) address assigned to Jacobus De Beer (AS327991) within the 102.64.35.0/24 block. The IP presents moderate risk with no open services detected (firewalled/no services), limited threat indicators, and a subnet with low abuse density (8.99%). Recommended action: Monitor or block based on organizational policy.

\---

\## Technical Profile

**Ownership:**

\- ASN: 327991

\- Organization: Jacobus De Beer

\- Network: 102.64.35.0/24

\- RIR: AFRINIC

**Geolocation:**

\- Country: South Africa (ZA)

\- Region: Gauteng

\- City: Vanderbijlpark

\- Timezone: Africa/Johannesburg

\- Accuracy Radius: 800km

**Network Role:**

\- Infrastructure Type: Firewalled / No Services

\- Not classified as cloud, CDN, VPN, proxy, or hosting service

\---

\## Threat Assessment

**Risk Indicators:**

\- Risk Score: 40/100 (Moderate)

\- Abuse Confidence Score: Not applicable (no active abuse signals)

\- Known Attacker: No

\- Spam Source: No

\- Tor Exit Node: No

\- Active Campaigns: None observed

**Blacklist Status:**

\- DNSBL Listed: 2 out of 8 total lists

\- Maximum Severity: High

\- No PULSedive risk data available

**Network Context:**

\- Subnet Abuse Density: 8.99%

\- Classification: mostly_clean

\- Threat Siblings in /24: 8 out of 89 total

\- Inherited Risk Score: 3

\---

\## DNS Analysis

**Reverse DNS:**

\- PTR Hostname: ms-35-59.megasurf.co.za

\- Domain: co.za

\- Forward Resolution: Confirmed (1 host)

**Email Authentication:**

\- SPF Record: Present

\- DMARC Record: Present

**DNSSEC:**

\- Valid: Yes

\---

\## Service Enumeration

**Open Ports:** None detected

**HTTP/HTTPS:** No services accessible

**TLS Certificate:** None

**Banner Grab:** No service banners detected

\---

\## Observation History

**Signal Count:** 17 observations recorded

**Recent Activity:** 2026-07-19

\- Subnet abuse density: 8.99%

\- Classification: mostly_clean

\- DNSSEC validity confirmed

\- Blacklist listings observed (2 high-severity)

\- Geolocation inference: South Africa (52% confidence)

\---

\## Related Entities

**DNS Associations:**

\- ms-35-59.megasurf.co.za

**Network Associations:**

\- 102.64.35.0/24 (Same Network)

\---

\## Recommended Actions

**Firewall Rules:**

\- iptables: \`iptables -A INPUT -s 102.64.35.59 -j DROP\`

\- nftables: \`nft add rule inet filter input ip saddr 102.64.35.59 drop\`

\- NGINX: \`deny 102.64.35.59;\`

\- pfSense: \`102.64.35.59/32\`

**WAF Rules:**

\- Cloudflare WAF: Block IP with expression \`ip.src eq 102.64.35.59\`

\- AWS WAF: Block IP 102.64.35.59/32 with description "IPDebrief risk 40"

\---

\## Analyst Notes

\- The IP shows no active services or open ports; traffic appears blocked at the source.

\- Subnet neighbors include 89 total addresses with 34 active, 8 flagged as threats.

\- DNSSEC valid status and SPF/DMARC presence suggest legitimate infrastructure.

\- Two DNSBL listings with high severity warrant monitoring even if no active abuse detected.

\- Route stability marked false; BGP prefix may have recent changes.

**Recommendation:** Add to threat monitoring list. Block if organization policy prohibits traffic from South African IPs with risk scores ≥40. Reassess after 7 days if no malicious activity observed.

## Nearby addresses

- 102.64.35.1 (https://ipdebrief.com/102.64.35.1)
- 102.64.35.3 (https://ipdebrief.com/102.64.35.3)
- 102.64.35.4 (https://ipdebrief.com/102.64.35.4)
- 102.64.35.5 (https://ipdebrief.com/102.64.35.5)
- 102.64.35.6 (https://ipdebrief.com/102.64.35.6)
- 102.64.35.7 (https://ipdebrief.com/102.64.35.7)
- 102.64.35.10 (https://ipdebrief.com/102.64.35.10)
- 102.64.35.11 (https://ipdebrief.com/102.64.35.11)
- 102.64.35.12 (https://ipdebrief.com/102.64.35.12)
- 102.64.35.13 (https://ipdebrief.com/102.64.35.13)
- 102.64.35.14 (https://ipdebrief.com/102.64.35.14)
- 102.64.35.17 (https://ipdebrief.com/102.64.35.17)

---

Source: IPDebrief, "102.64.35.59 IP intelligence", https://ipdebrief.com/102.64.35.59, updated 2026-10-07. Assessments are probabilistic.