37.221.133.70📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 37.221.133.70/32

Date: 2026-07-30

Classification: HIGH RISK

---

## EXECUTIVE SUMMARY

IP address 37.221.133.70 is assigned to Radio Service Ltd. (ASN 62384) within the RADIOSERVICE-201712 network block. The IP presents an elevated threat profile with a risk score of 80/100. While no active threat indicators are currently present, the IP is DNSBL-listed on 4 of 8 blacklist sources and operates within a subnet showing moderate abuse density.

---

## OWNERSHIP & INFRASTRUCTURE

• Organization: Radio Service Ltd.
• ASN: 62384
• Network Block: 37.221.128.0/20
• Geolocation: Warsaw, Ukraine (UA) – geolocation consensus indicates mixed confidence
• Infrastructure Status: Firewalled / No Services detected
• DNSBL Status: Listed on 4 of 8 blacklist sources
• Routing State: Route stability flagged as inconsistent

---

## THREAT PROFILE

Risk Score: 80/100 (High Risk)

Current Threat Indicators:

• No active malicious campaigns detected
• Not classified as Tor exit node, known attacker, or spam source
• No open ports or running services observed
• No TLS certificates or reverse DNS entries

Control Plane Metrics:

• DNSBL Listed Count: 4
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not evaluated
• Route Stability: Inconsistent

---

## NEIGHBORHOOD ANALYSIS (37.221.133.0/24)

• Total Subnet IPs: 18
• Active Siblings: 13
• Threat Siblings: 3
• Abuse Density: 0.1667 (Moderate)
• Inherited Risk Score: 6

Notable High-Risk Neighbors (Risk Score 55):

• 37.221.133.8
• 37.221.133.57
• 37.221.133.88
• 37.221.133.91
• 37.221.133.147
• 37.221.133.163
• 37.221.133.249

Low-Risk Neighbors (Risk Score 15-30):

• 37.221.133.111, 122, 187 (15)
• 37.221.133.104, 140 (30)

---

## OBSERVATION HISTORY

Total Observations: 17

Recent Activity (2026-07-30):

• Multiple geo-validation probes confirming Warsaw location with plausible RTT measurements (124-131ms)
• Traceroute analysis: 12 hops to target, 4 timed-out hops
• No ownership changes detected
• No persistent malicious behavior observed

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: False

---

## NETWORK CLASSIFICATION

• Provider: No
• Infrastructure Type: No
• Cloud: No
• CDN: No
• VPN: No
• Proxy: No
• Tor: No
• Hosting: No
• Mobile: No
• Residential: No
• Bogon: No
• Anycast: No

---

## RECOMMENDED ACTIONS

Priority: CRITICAL

1. Immediate Blocking:

```bash

# iptables

iptables -A INPUT -s 37.221.133.70 -j DROP

# nftables

nft add rule inet filter input ip saddr 37.221.133.70 drop

# nginx

deny 37.221.133.70;

# pfSense

37.221.133.70/32

# Cloudflare WAF

{"description":"Block 37.221.133.70 — IPDebrief risk score 80","action":"block"}

# AWS WAF

{"Addresses":["37.221.133.70/32"],"Description":"IPDebrief risk 80"}

```

2. Monitoring Recommendations:

• Increase logging verbosity for this IP address
• Review recent network activity patterns
• Monitor for lateral movement within the 37.221.133.0/24 subnet
• Track DNSBL listing changes

3. Subnet-Level Considerations:

• Evaluate blocking additional high-risk neighbors (Risk Score 55)
• Monitor the 12 medium-risk siblings in the /24
• Consider implementing subnet-level rate limiting for 37.221.133.0/24

---

## ANALYST NOTES

The IP 37.221.133.70 presents a moderate-to-high risk profile primarily driven by DNSBL listings and neighborhood context. While no active exploitation indicators are present, the elevated risk score warrants immediate blocking with subsequent monitoring. The subnet shows mixed risk distribution—3 threat siblings among 18 total IPs—suggesting targeted abuse rather than widespread compromise. Correlate with other threat intelligence sources before implementing permanent blocks, particularly given the infrastructure appears firewalled with no active services.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.