102.64.39.143📋 Copy

# IP Intelligence Briefing: 102.64.39.143

Classification: Moderate Risk | Risk Score: 55/100 | Report Date: Current

## Executive Summary

IP 102.64.39.143 is a South African residential/infrastructure address classified as Moderate Risk (55/100). The IP belongs to Jacobus De Beer (AS327991) within the AFRINIC registry. While the address shows no active threat indicators, it is listed on 3 out of 8 DNSBL feeds and exhibits moderate risk characteristics that warrant monitoring.

## Ownership and Geolocation

• Organization: Jacobus De Beer
• ASN: 327991
• CIDR Block: 102.64.39.0/24
• Geolocation: Vanderbijlpark, Gauteng, South Africa (ZA)
• RIR: AFRINIC
• Registration: Historical data indicates 3,779 days of delegation age

## Network Classification

The IP is classified as Firewalled / No Services with no open ports detected. Network role assessment indicates this is not a provider, CDN, VPN, proxy, Tor exit node, or hosting service. The address is not bogon and is part of a legitimate allocated block.

## DNS Analysis

• PTR Hostname: ms-39-143.megasurf.co.za
• Forward Resolution: Confirmed (1 hostname)
• Email Authentication: SPF and DMARC records present
• DNSBL Status: Listed on 3 of 8 available threat feeds
• Hosted Domains: 0

## Threat Assessment

Current Threat Indicators: None detected

• Known attacker: No
• Spam source: No
• Tor exit: No
• Blacklist count: 0 (application-layer blacklists)
• Known campaigns: None

Control Plane:

• Route changes (30 days): 1
• Route stability: Unstable
• DNSSEC: Valid
• IRR consistency: Pending verification
• Operator score: 0.2609 (Basic)

## Neighborhood Analysis (102.64.39.0/24)

• Subnet Abuse Density: 1.2% (0.012)
• Total Siblings: 254 IPs
• Risk Distribution:

- High Risk: 1

- Medium Risk: 53

- Low Risk: 23

• Notable Neighbor: 102.64.39.14 (Risk: 40)

## Historical Observations

21 observations recorded through July 27, 2026. Recent activity includes:

• Traceroutes showing multi-hop paths to target
• Geo data discrepancies (some hops resolving to London, GB via 171.75.9.213)
• Service scans with no open ports detected
• Ownership and threat persistence metrics remain stable

## Recommended Actions

Immediate:

• Increase logging verbosity for traffic from this IP
• Review recent activity patterns for anomalies

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 102.64.39.143 -j DROP

# nftables

nft add rule inet filter input ip saddr 102.64.39.143 drop

# pfSense

102.64.39.143/32

# Cloudflare WAF

{"description":"Block 102.64.39.143 — IPDebrief risk score 55","action":"block"}

```

Assessment: The IP presents moderate risk without active malicious indicators. Blocking is recommended based on DNSBL presence and elevated risk score, but correlation with other telemetry signals is advised before implementing hard blocks. Monitor for emerging threat indicators in the 102.64.39.0/24 subnet.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.