37.221.130.198📋 Copy

# IP Intelligence Briefing: 37.221.130.198/32

## Executive Summary

IP address 37.221.130.198 is classified as Moderate Risk (55/100) with no active threat indicators. The address is assigned to Radio Service Ltd. (ASN 62384) within the 37.221.128.0/20 block, registered with RIPE in Ukraine. The IP is currently firewalled with no open services and shows no evidence of malicious activity.

## Ownership and Registration

• Organization: Radio Service Ltd.
• Network Name: RADIOSERVICE-201712
• ASN: 62384
• CIDR Block: 37.221.128.0/20
• RIR: RIPE
• Abuse Contact: abuse@radioservice.net.ua
• Registration Date: Historical data available via RDAP

## Geolocation

• Country: Ukraine (UA)
• City: Lviv
• Coordinates: 48.38°N, 31.17°E
• Timezone: Europe/Kyiv
• Accuracy Radius: 500km

## Network Role and Classification

• Infrastructure Type: No active services (Firewalled)
• Service Purpose: None detected
• Not classified as: Cloud, CDN, VPN, Proxy, Tor, Hosting, or Mobile network
• DNS Resolution: Forward resolution not confirmed
• PTR Records: None
• Email Auth: No SPF/DMARC records present

## Threat Intelligence

• Risk Score: 55 (Moderate)
• Blacklist Count: 0
• DNSBL Listings: 3 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None
• Known Campaigns: None
• Cert Matches: 0
• Correlated IPs: 0

## Services and Ports

• Open Ports: None detected
• TLS Certificates: None
• HTTP Title: None
• Server Banner: None

## Control Plane Analysis

• Route Stability: Unstable (isRouteStable: false)
• BGP Prefix: 37.221.128.0/20
• Origin ASN: 62384
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated
• Route Changes (30d): 0
• DNSSEC Valid: Yes
• Operator Score: 0.1304 (Minimal)

## Observation History

Analysis of 14 historical observations (most recent: 2026-07-25) indicates:

• Geolocation signals consistently place the IP in Ukraine
• Ownership signals consistently identify Radio Service Ltd.
• No persistent malicious activity detected
• No ownership changes observed
• Average threat observation count: 0
• Confidence scores range from 0.30 to 0.90 across different signal types

## Neighborhood Analysis (37.221.130.0/24)

• Subnet: 37.221.130.198/24
• Total Neighbors: 13
• Abuse Density: 7.7%
• Risk Distribution: High (1), Medium (8), Low (4)

Notable High-Risk Neighbors:

## Relationships

• Same Network: RADIOSERVICE-201712 (2 relationships identified)
• No external entity relationships detected (hostnames, organizations, certificates)

## Traceroute Analysis

• Hop Count: 13
• First Hop RTT: 0.4ms
• Last Hop RTT: 129.4ms
• Timed Out Hops: 3
• Transit Network: Comcast

## Recommended Actions

Based on the IP's moderate risk profile and current operational status:

1. No immediate blocking recommended - No active threat indicators present

2. Monitor subnet abuse density - 7.7% abuse rate suggests periodic review of adjacent addresses

3. Review DNSBL listings - IP is listed on 3 of 8 DNSBLs; verify legitimacy

4. Consider rate limiting - Standard practice for moderate-risk IPs with no active services

5. Monitor for service changes - IP currently firewalled; monitor for port opening

## Intelligence Assessment

IP 37.221.130.198 represents a low-priority defensive security concern. The address belongs to a legitimate ISP/infrastructure provider (Radio Service Ltd.) in Ukraine with no evidence of active malicious use. However, the subnet exhibits elevated abuse density (7.7%) with one high-risk neighbor (37.221.130.237, Risk 80) and three moderate-risk neighbors. SOC teams should maintain awareness of the subnet but no immediate blocking is warranted based on current data.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.