# 102.64.39.143 — IP Intelligence Summary

102.64.39.143 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-39-143.megasurf.co.za. As of October 7, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/102.64.39.143
- Last updated: 2026-10-07

## Ownership

- Organization: Jacobus De Beer
- Network name: 102.64.39.0 - 102.64.39.255
- Allocated block: 102.64.39.0/24
- ASN: AS327991 (https://ipdebrief.com/asn/327991)
- Regional registry: AFRINIC

## Location

- City: Vanderbijlpark
- Region: Gauteng
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ms-39-143.megasurf.co.za
- Forward-confirmed: yes

## Analyst narrative

\# IP Intelligence Briefing: 102.64.39.143

**Classification:** Moderate Risk | **Risk Score:** 55/100 | **Report Date:** Current

\## Executive Summary

IP 102.64.39.143 is a South African residential/infrastructure address classified as Moderate Risk (55/100). The IP belongs to Jacobus De Beer (AS327991) within the AFRINIC registry. While the address shows no active threat indicators, it is listed on 3 out of 8 DNSBL feeds and exhibits moderate risk characteristics that warrant monitoring.

\## Ownership and Geolocation

\- **Organization:** Jacobus De Beer

\- **ASN:** 327991

\- **CIDR Block:** 102.64.39.0/24

\- **Geolocation:** Vanderbijlpark, Gauteng, South Africa (ZA)

\- **RIR:** AFRINIC

\- **Registration:** Historical data indicates 3,779 days of delegation age

\## Network Classification

The IP is classified as **Firewalled / No Services** with no open ports detected. Network role assessment indicates this is not a provider, CDN, VPN, proxy, Tor exit node, or hosting service. The address is **not bogon** and is part of a legitimate allocated block.

\## DNS Analysis

\- **PTR Hostname:** ms-39-143.megasurf.co.za

\- **Forward Resolution:** Confirmed (1 hostname)

\- **Email Authentication:** SPF and DMARC records present

\- **DNSBL Status:** Listed on 3 of 8 available threat feeds

\- **Hosted Domains:** 0

\## Threat Assessment

**Current Threat Indicators:** None detected

\- Known attacker: No

\- Spam source: No

\- Tor exit: No

\- Blacklist count: 0 (application-layer blacklists)

\- Known campaigns: None

**Control Plane:**

\- Route changes (30 days): 1

\- Route stability: Unstable

\- DNSSEC: Valid

\- IRR consistency: Pending verification

\- Operator score: 0.2609 (Basic)

\## Neighborhood Analysis (102.64.39.0/24)

\- **Subnet Abuse Density:** 1.2% (0.012)

\- **Total Siblings:** 254 IPs

\- **Risk Distribution:**

\- High Risk: 1

\- Medium Risk: 53

\- Low Risk: 23

\- **Notable Neighbor:** 102.64.39.14 (Risk: 40)

\## Historical Observations

21 observations recorded through July 27, 2026. Recent activity includes:

\- Traceroutes showing multi-hop paths to target

\- Geo data discrepancies (some hops resolving to London, GB via 171.75.9.213)

\- Service scans with no open ports detected

\- Ownership and threat persistence metrics remain stable

\## Recommended Actions

**Immediate:**

\- Increase logging verbosity for traffic from this IP

\- Review recent activity patterns for anomalies

**Firewall Rules:**

\`\`\`bash

\# iptables

iptables -A INPUT -s 102.64.39.143 -j DROP

\# nftables

nft add rule inet filter input ip saddr 102.64.39.143 drop

\# pfSense

102.64.39.143/32

\# Cloudflare WAF

{"description":"Block 102.64.39.143 — IPDebrief risk score 55","action":"block"}

\`\`\`

**Assessment:** The IP presents moderate risk without active malicious indicators. Blocking is recommended based on DNSBL presence and elevated risk score, but correlation with other telemetry signals is advised before implementing hard blocks. Monitor for emerging threat indicators in the 102.64.39.0/24 subnet.

## Nearby addresses

- 102.64.39.7 (https://ipdebrief.com/102.64.39.7)
- 102.64.39.9 (https://ipdebrief.com/102.64.39.9)
- 102.64.39.10 (https://ipdebrief.com/102.64.39.10)
- 102.64.39.12 (https://ipdebrief.com/102.64.39.12)
- 102.64.39.14 (https://ipdebrief.com/102.64.39.14)
- 102.64.39.15 (https://ipdebrief.com/102.64.39.15)
- 102.64.39.20 (https://ipdebrief.com/102.64.39.20)
- 102.64.39.21 (https://ipdebrief.com/102.64.39.21)
- 102.64.39.23 (https://ipdebrief.com/102.64.39.23)
- 102.64.39.24 (https://ipdebrief.com/102.64.39.24)
- 102.64.39.31 (https://ipdebrief.com/102.64.39.31)
- 102.64.39.32 (https://ipdebrief.com/102.64.39.32)

---

Source: IPDebrief, "102.64.39.143 IP intelligence", https://ipdebrief.com/102.64.39.143, updated 2026-10-07. Assessments are probabilistic.