37.221.139.124📋 Copy

# IP INTELLIGENCE BRIEFING: 37.221.139.124

Classification: Moderate Risk | Date: June 2026 | Source: IPDebrief Intelligence Platform

## Executive Summary

IP 37.221.139.124 is a moderate-risk address (Risk Score: 40/100) assigned to Radio Service Ltd. (ASN 62384) in Ukraine. The IP exhibits DNSBL listing activity and operates within a subnet showing mixed abuse characteristics. Current threat indicators indicate firewalling behavior with no active open services.

## Key Findings

Ownership & Infrastructure

• Organization: Radio Service Ltd.
• ASN: 62384
• Country: Ukraine (UA)
• City: Nyzhnia Rozhanka
• Network Block: 37.221.128.0/20
• Registration: Via RIR RIPE

Threat Assessment

• Risk Score: 40 (Moderate)
• DNSBL Listings: 2 of 8 total lists flagged
• DNSBL Max Severity: High
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Network Behavior

• Service State: Firewalled / No Services Detected
• Open Ports: None observed
• Certificate Authority: No TLS certificates present
• BGP Route Stability: Unstable (route changes detected in 30-day window)

## Neighborhood Analysis

The /24 subnet (37.221.139.0/24) exhibits mixed abuse characteristics:

• Abuse Density: 5.3%
• Risk Distribution: 1 High, 12 Medium, 6 Low risk IPs
• Total Siblings Analyzed: 19
• Threat Siblings: 5 identified
• Subnet Classification: Mixed

Notable high-risk neighbors include 37.221.139.46 (Risk: 80) and multiple IPs scoring 55, indicating concentrated risk activity within the subnet.

## Historical Observations

Signal history reveals recurring DNSBL listings with high-severity flags. Most recent observations (June 23, 2026) show:

• 3 out of 8 DNSBL listings active
• Operator score: Minimal (0.1304)
• Threat persistence: Not established (0 days)
• Total incidents: 0

The IP shows no persistent malicious behavior pattern despite DNSBL presence.

## Relationship Graph

All 15 relationship endpoints map to network identifier RADIOSERVICE-201712, confirming network-level association rather than multi-tenant infrastructure.

## Recommended Actions

Based on risk profile, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 37.221.139.124 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 37.221.139.124 drop

```

nginx:

```nginx

deny 37.221.139.124;

```

Cloudflare WAF:

```json

{

"action": "block",

"filter": {

"expression": "ip.src eq 37.221.139.124"

}

}

```

AWS WAF:

```json

{

"Addresses": ["37.221.139.124/32"],

"Description": "IPDebrief risk 40"

}

```

## Intelligence Notes

• GeoPlausibility validation: False (indicates data inconsistency)
• DNSSEC: Valid
• ISP Classification: Minimal operator score
• No honeypot strikes or enumeration activity observed
• Campaign correlation: None detected

Recommendation: Apply blocking rules pending correlation with other threat signals. Monitor subnet 37.221.139.0/24 for additional activity patterns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.