37.202.72.26📋 Copy

# IP Intelligence Briefing: 37.202.72.26/32

Date: July 23, 2026

Classification: Low Risk

Prepared For: SOC Operations

---

## Executive Summary

IP address 37.202.72.26 is registered to GO-JOR (ASN 8376) within the L2ADSL network block (37.202.64.0/19). The address maintains a low-risk profile with a risk score of 25/100. No active threat indicators or malicious activity were observed during analysis. The IP presents minimal operational risk for defensive monitoring.

---

## Infrastructure Profile

Geolocation Analysis

Geographic data presents conflicting signals across observation sources. The control plane profile indicates US (New York) placement with 2 geolocation sources, while historical signals consistently identify Amman, Jordan (JO). This geographic inconsistency warrants periodic verification but does not indicate active malicious behavior.

Network Classification

• Infrastructure Type: Undetermined
• Network Role: Firewalled / No Services
• Cloud/CDN/VPN: Negative indicators across all categories
• Operator Score: Minimal (0.1304)

---

## Threat Assessment

Risk Metrics

• Overall Risk Score: 25/100 (Low Risk)
• Provider Risk Score: 0/100
• Authority Risk Score: 0/100
• Abuse Confidence Score: Not available

Threat Indicators

• Blacklist Count: 0 (profile) / DNSBL listed on 1 of 8 total lists (control plane)
• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Known Campaigns: None detected
• Threat Persistence: 0 days observed

DNS Analysis

• PTR Resolution: None
• Forward Resolution: Not confirmed
• Hosted Domains: 0
• Email Authentication: No SPF, DMARC, or TXT records detected

---

## Network Behavior

Service Enumeration

• Open Ports: None detected
• TLS Certificate: Not present
• HTTP Banner: Not detected
• Service Purpose: Firewalled / No Services

Historical Observations

Twelve observation signals recorded. Recent observations (July 23, 2026) confirm:

• Provider attribution to GO-JOR with abuse contact abuse@go.com.jo
• Minimal operator classification score
• Consistent Jordanian geolocation signals (Amman, JO)

---

## Neighborhood Analysis

Subnet: 37.202.72.26/24

• Active Siblings: 0
• Threat Siblings: 0
• Abuse Density: 0
• Risk Distribution: No high or medium risk neighbors identified

The surrounding /24 subnet shows no adjacent malicious activity, indicating this IP operates in isolation from other compromised addresses.

---

## Relationships

• Primary Relationship: Same Network (L2ADSL)
• Related Entities: 1 network-level association identified
• Certificate Matches: 0
• Correlated IPs: 0

---

## Security Recommendations

Immediate Actions

No immediate firewall or blocking actions recommended based on current risk profile.

Monitoring Considerations

1. Geographic Verification: Monitor for persistent US vs. Jordan geolocation conflicts

2. DNSBL Monitoring: Track DNSBL listing status across 8 threat intelligence feeds

3. Service Emergence: Watch for sudden service enumeration or port opening

Firewall Configuration

No specific firewall rules generated. Standard egress/ingress filtering applies.

---

## Conclusion

IP 37.202.72.26 represents a low-risk network endpoint with no active threat indicators. The infrastructure appears stable with minimal operator activity. Geographic data inconsistencies should be noted but do not currently pose operational risk. Continue standard monitoring practices and review if service enumeration occurs or if threat indicators emerge.

Status: Monitor

Priority: Low

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.