# 102.64.42.58 — IP Intelligence Summary 102.64.42.58 is an IPv4 address operated by Jacobus De Beer (AS327991), geolocated to Vanderbijlpark, South Africa. Its reverse DNS name is ms-42-58.megasurf.co.za. As of November 4, 2026, IPDebrief rates it Moderate Risk (65/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/102.64.42.58 - Last updated: 2026-11-04 ## Ownership - Organization: Jacobus De Beer - Network name: 102.64.42.0 - 102.64.42.255 - Allocated block: 102.64.42.0/24 - ASN: AS327991 (https://ipdebrief.com/asn/327991) - Regional registry: AFRINIC ## Location - City: Vanderbijlpark - Region: Gauteng - Country: South Africa - Time zone: Africa/Johannesburg ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (65/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Reverse DNS - ms-42-58.megasurf.co.za - Forward-confirmed: yes ## Analyst narrative \## IP Intelligence Briefing: 102.64.42.58/32 **Classification:** Moderate Risk | **Report Date:** 2026-07-21 \--- \### Executive Summary IP 102.64.42.58 presents a moderate risk profile (score 40/100) with no active threat indicators. The address belongs to South African infrastructure under ASN 327991 (Jacobus De Beer) and resolves to a residential/reseller DNS hostname (ms-42-58.megasurf.co.za). While currently non-malicious, the IP appears in 2 of 8 DNSBLs and the /24 neighborhood exhibits mixed risk characteristics requiring monitoring. \--- \### Network Ownership & Infrastructure \- **Organization:** Jacobus De Beer \- **ASN:** 327991 (AFRIINIC registry) \- **CIDR Block:** 102.64.42.0 - 102.64.42.255 \- **Geolocation:** Gauteng, Vanderbijlpark, South Africa (800km accuracy radius) \- **Network Role:** Firewalled / No Services Detected \- **Infrastructure Type:** Not cloud, CDN, VPN, proxy, or hosting \--- \### Threat Assessment **Current Threat Indicators:** None detected \- Not a Tor exit node \- Not a known attacker or spam source \- No active threat feeds matches \- No known campaign associations **DNSBL Status:** Listed on 2 of 8 threat intelligence feeds **DNS Reputation:** Forward confirmed with valid PTR (ms-42-58.megasurf.co.za). SPF and DMARC records present. \--- \### Neighborhood Analysis (102.64.42.0/24) \- **Abuse Density:** 0.011 (Low) \- **Subnet Classification:** Mostly Clean \- **Total Siblings:** 90 IPs \- **Active Siblings:** 29 \- **Threat Siblings:** 5 \- **Risk Distribution:** High (1), Medium (48), Low (17) \- **Inherited Risk Score:** 2 *Note: The subnet contains elevated-risk neighbors (e.g., 102.64.42.13 score 70, 102.64.42.11 score 55). Monitor for correlation.* \--- \### Control Plane & Routing \- **BGP Prefix:** 102.64.40.0/21 \- **RPKI State:** Not verified \- **Route Stability:** Unstable \- **DNSSEC:** Valid \- **Origin ASN:** 327991 \--- \### Historical Signals 19 observations recorded since 2026-07-21. Signals indicate consistent ownership, stable geolocation inference (South Africa), and no persistent malicious behavior. The IP has not shown escalating threat patterns. \--- \### Recommended Security Actions **Immediate Firewall Rules:** \`\`\`bash \# iptables iptables -A INPUT -s 102.64.42.58 -j DROP \# nftables nft add rule inet filter input ip saddr 102.64.42.58 drop \# nginx deny 102.64.42.58; \# pfSense 102.64.42.58/32 \`\`\` **Cloud Platform Configuration:** \- **Cloudflare WAF:** Block IP with expression: \`ip.src eq 102.64.42.58\` \- **AWS WAF:** Add IP address 102.64.42.58/32 to rule set **Monitoring Recommendations:** 1. Monitor for service initiation (currently firewalled) 2. Watch neighborhood IPs 102.64.42.11 and 102.64.42.13 for correlation 3. Track DNSBL additions/removals 4. Observe for any changes in geolocation or ownership \--- \### Intelligence Narrative This South African residential/reseller IP (102.64.42.58) demonstrates moderate-risk characteristics primarily due to DNSBL listings and neighborhood context rather than direct malicious activity. The IP's DNS hostname pattern (ms-42-58.megasurf.co.za) indicates a shared hosting/reseller infrastructure. While current threat signals are absent, the subnet's mixed risk profile (1 high-risk neighbor) warrants continued monitoring. The recommendation to block aligns with the IP's moderate risk score and DNSBL presence, though operational context should inform final disposition. ## Nearby addresses - 102.64.42.1 (https://ipdebrief.com/102.64.42.1) - 102.64.42.2 (https://ipdebrief.com/102.64.42.2) - 102.64.42.3 (https://ipdebrief.com/102.64.42.3) - 102.64.42.4 (https://ipdebrief.com/102.64.42.4) - 102.64.42.5 (https://ipdebrief.com/102.64.42.5) - 102.64.42.9 (https://ipdebrief.com/102.64.42.9) - 102.64.42.11 (https://ipdebrief.com/102.64.42.11) - 102.64.42.12 (https://ipdebrief.com/102.64.42.12) - 102.64.42.13 (https://ipdebrief.com/102.64.42.13) - 102.64.42.15 (https://ipdebrief.com/102.64.42.15) - 102.64.42.16 (https://ipdebrief.com/102.64.42.16) - 102.64.42.17 (https://ipdebrief.com/102.64.42.17) --- Source: IPDebrief, "102.64.42.58 IP intelligence", https://ipdebrief.com/102.64.42.58, updated 2026-11-04. Assessments are probabilistic.