102.64.35.91📋 Copy

# IP Intelligence Briefing: 102.64.35.91/32

Classification: High Risk

Report Date: 2026-07-30

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 102.64.35.91 is classified as High Risk with a risk score of 80. The address is registered to Jacobus De Beer (ASN 327991) within the 102.64.35.0/24 CIDR block in Vanderbijlpark, Gauteng, South Africa. The IP exhibits elevated threat indicators including DNSBL listings (4 of 8 total), though no open services are detected at the time of analysis.

---

## Technical Profile

---

## Threat Indicators

• DNSBL Presence: IP listed on 4 DNS blacklists out of 8 total checks, indicating prior association with malicious activity
• Operator Score: 0.2609 (Basic operator classification)
• Control Plane: Route stability flagged as false; BGP prefix 102.64.32.0/21
• Services: No open ports detected; connection type not classified

---

## Historical Observations

Twelve signal observations recorded, with the most recent activity from 2026-07-30. Historical data shows:

• Consistent ownership attribution to Jacobus De Beer
• Persistent DNS associations with megasurf.co.za infrastructure
• Blacklist listings observed across multiple reputation feeds
• No evidence of evolving threat behavior or campaign activity

---

## Network Neighborhood Analysis

Subnet 102.64.35.0/24 contains 100 sibling IPs with the following risk distribution:

• High Risk: 5 IPs
• Medium Risk: 77 IPs
• Low Risk: 16 IPs
• Abuse Density: 0.05 (5%)

Notable neighbors include IPs with risk scores ranging from 30-55, indicating a heterogeneous network with mixed reputation levels.

---

## Relationships

DNS associations resolve to hostname ms-35-91.megasurf.co.za. No organizational or campaign-level relationships detected beyond DNS and network associations.

---

## Recommended Actions

Firewall Recommendation: Block inbound traffic to 102.64.35.91 due to DNSBL listings and high risk score. No immediate blocking required for outbound connections unless previously observed as C2.

---

## Intelligence Narrative

The target IP 102.64.35.91 presents a high-risk profile (80/100) despite showing no active services. The DNSBL listings (4 of 8) suggest prior engagement with malicious infrastructure, potentially indicating use in past campaigns. The hostname "megasurf.co.za" suggests association with hosting or measurement services, which may have been leveraged for proxy or relay activities. The subnet exhibits moderate abuse density (5%), with neighboring IPs showing mixed risk profiles. No current threat indicators (Tor exit, known attacker, spam source) are active, but the historical blacklist activity warrants defensive monitoring.

Assessment: Monitor and block traffic to this IP. Investigate subnet 102.64.35.0/24 for lateral threat patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.