# 102.64.37.98 — IP Intelligence Summary 102.64.37.98 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-37-98.megasurf.co.za. As of October 31, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/102.64.37.98 - Last updated: 2026-10-31 ## Ownership - Organization: Jacobus De Beer - Network name: 102.64.37.0 - 102.64.37.255 - Allocated block: 102.64.37.0/24 - ASN: AS327991 (https://ipdebrief.com/asn/327991) - Regional registry: AFRINIC ## Location - City: Vanderbijlpark - Region: Gauteng - Country: South Africa - Time zone: Africa/Johannesburg ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (40/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - ms-37-98.megasurf.co.za - Forward-confirmed: yes ## Analyst narrative \# IP INTELLIGENCE BRIEFING: 102.64.37.98/32 \## EXECUTIVE SUMMARY IP address 102.64.37.98 is assessed as **MODERATE RISK** (Risk Score: 40/100). The address is geolocated to Vanderbijlpark, Gauteng, South Africa (ZA), under ASN 327991 (Jacobus De Beer). Currently firewalled with no open services detected. Two DNSBL listings recorded across eight total threat feeds. Geographic signals show inconsistency between African and European indicators, suggesting potential routing anomalies or proxy usage. \--- \## NETWORK OWNERSHIP & INFRASTRUCTURE \- **ASN:** 327991 \- **Organization:** Jacobus De Beer \- **CIDR Block:** 102.64.37.0 - 102.64.37.255 \- **RIR:** AFRINIC \- **Service Classification:** Firewalled / No Services \- **Network Role:** Not classified as provider, CDN, VPN, proxy, Tor, hosting, mobile, or cloud infrastructure \--- \## GEOGRAPHIC ANALYSIS \- **Primary Location:** Vanderbijlpark, Gauteng, South Africa (ZA) \- **Region:** Africa (Africa/Johannesburg timezone) \- **Accuracy:** 800km radius \- **Signal Consensus:** True (1 geo source) \- **Note:** Recent traceroute observations (2026-07-27) showed routing through London, UK infrastructure (ae1.3115.edge7.lon1.neo.colt.net), indicating potential multi-hop routing or proxy path. \--- \## DNS & IDENTIFIERS \- **PTR Hostname:** ms-37-98.megasurf.co.za \- **Forward Resolution:** Confirmed \- **Domain:** co.za \- **Email Authentication:** SPF and DMARC records present \- **Reverse DNS:** Active and resolving correctly \--- \## THREAT INDICATORS \- **Abuse Confidence Score:** Not available \- **Known Attacker:** False \- **Known Spam Source:** False \- **Tor Exit Node:** False \- **Blacklist Count:** 2 lists \- **Threat Feeds:** No active threat indicators \- **Campaign Correlation:** No correlated campaigns detected \--- \## NEIGHBORHOOD ANALYSIS (102.64.37.0/24) \- **Total Siblings:** 93 \- **Active Siblings:** 36 \- **Threat Siblings:** 5 \- **Abuse Density:** 0.011 (low) \- **Classification:** Mostly Clean \- **Inherited Risk:** 2 **Notable Neighbor:** 102.64.37.21 (Risk Score: 70, Authority Score: 60) — Requires monitoring. **Risk Distribution:** \- High Risk: 1 \- Medium Risk: 61 \- Low Risk: 23 \--- \## OBSERVATION HISTORY (17 Observations) Recent activity shows mixed geographic signals with one London-based geolocation observation on 2026-07-27, despite primary location being South Africa. Abuse density remained stable at 0.0538. Network classification consistently shows "mostly_clean" status. No persistent malicious behavior detected. \--- \## SOC ACTIONABLE INTELLIGENCE \### MONITORING RECOMMENDATIONS \- **Flag for Review:** The IP is moderate risk with DNSBL presence. Monitor for service activation. \- **Neighborhood Watch:** Track 102.64.37.21 (Risk: 70) as high-risk neighbor. \- **Geographic Anomaly:** Investigate routing through UK infrastructure for potential proxy/relay behavior. \- **Threat Level:** Medium-priority monitoring due to moderate risk score and DNSBL listings. \### FIREWALL/ACCESS CONTROL \- No immediate block recommended based on current profile. \- Consider rate-limiting inbound connections if service activation occurs. \- Monitor for changes in DNS resolution patterns. \### THREAT INTELLIGENCE CONTEXT This IP represents a residential or small business network endpoint in South Africa with firewalled configuration. The moderate risk score stems primarily from DNSBL presence rather than active exploit or abuse indicators. Geographic signal inconsistency warrants periodic review but does not currently indicate active compromise. \--- **Report Generated:** 2026-07-27 **Classification:** INTERNAL USE — SOC ANALYSIS **IP Address:** 102.64.37.98/32 ## Nearby addresses - 102.64.37.1 (https://ipdebrief.com/102.64.37.1) - 102.64.37.3 (https://ipdebrief.com/102.64.37.3) - 102.64.37.4 (https://ipdebrief.com/102.64.37.4) - 102.64.37.5 (https://ipdebrief.com/102.64.37.5) - 102.64.37.6 (https://ipdebrief.com/102.64.37.6) - 102.64.37.8 (https://ipdebrief.com/102.64.37.8) - 102.64.37.13 (https://ipdebrief.com/102.64.37.13) - 102.64.37.14 (https://ipdebrief.com/102.64.37.14) - 102.64.37.15 (https://ipdebrief.com/102.64.37.15) - 102.64.37.21 (https://ipdebrief.com/102.64.37.21) - 102.64.37.23 (https://ipdebrief.com/102.64.37.23) - 102.64.37.24 (https://ipdebrief.com/102.64.37.24) --- Source: IPDebrief, "102.64.37.98 IP intelligence", https://ipdebrief.com/102.64.37.98, updated 2026-10-31. Assessments are probabilistic.