37.221.139.97📋 Copy

# IP INTELLIGENCE BRIEFING: 37.221.139.97/32

Date: 2026-07-24

Classification: Moderate Risk

Risk Score: 55/100

---

## 1. Ownership and Network Classification

The IP address 37.221.139.97 is allocated to Radio Service Ltd. (ASN 62384), under the network block RADIOSERVICE-201712 (37.221.128.0/20). The infrastructure is geolocated to Lviv, Ukraine (UA), with a 500km accuracy radius. Network classification indicates the IP is firewalled with no active services detected (no open ports, no TLS certificates, no HTTP banner). The IP is not classified as cloud, CDN, VPN, proxy, Tor, hosting, mobile, residential, or any other special infrastructure type.

Key Data:

• ASN: 62384
• Organization: Radio Service Ltd.
• CIDR Block: 37.221.128.0/20
• Location: Lviv, Ukraine
• Service Purpose: Firewalled / No Services

---

## 2. Threat Indicators and Reputation Signals

The IP registers 3 DNSBL listings out of 8 total blacklists checked. No threat indicators were identified, including no association with known campaigns, Tor exit nodes, or spam sources. However, the DNSBL listing count warrants attention as an indicator of prior abuse activity. The IP is not flagged as a known attacker.

Threat Summary:

• DNSBL Listed: 3/8 lists
• Known Campaigns: None
• Tor Exit Node: No
• Spam Source: No
• Abuse Confidence Score: N/A

---

## 3. Neighborhood Analysis

Analysis of the /24 subnet (37.221.139.0/24) reveals 24 sibling IPs with an abuse density of 0.167 (16.7%). Risk distribution shows 4 high-risk neighbors (risk score 80), 14 medium-risk (40), and 6 low-risk (15). Notable high-risk siblings include 37.221.139.36, 37.221.139.45, 37.221.139.46, and 37.221.139.124. Only 2 threat-siblings were identified across the subnet.

Subnet Risk Profile:

• Total Siblings: 25
• Active Siblings: 11
• Threat Siblings: 2
• Abuse Density: 0.167
• Classification: Mostly Clean (inherited risk: 3)

---

## 4. Observation History

Fifteen observations were recorded for this IP, with the most recent dated 2026-07-24. Historical signals indicate the subnet has been classified as "mostly_clean" with abuse density of 0.08. No persistent malicious behavior was detected. The IP has not changed ownership and shows no threat persistence indicators.

Historical Signals:

• Total Observations: 15
• Ownership Changes: 0
• Threat Persistence Days: 0
• Persistently Malicious: False
• Recent Classification: Mostly Clean

---

## 5. Relationships

Four relationships were identified, all pointing to the same network (RADIOSERVICE-201712). The relationship graph is limited, indicating this IP is primarily associated with its assigned network block rather than external entities such as hostnames, organizations, or certificates.

---

## 6. Recommended Security Actions

Given the elevated risk score of 55/100 and the presence of DNSBL listings, the following actions are recommended:

Immediate Actions:

• Increase logging verbosity and review recent activity from this IP
• Consider blocking at perimeter firewall if traffic patterns are suspicious

Firewall Rules:

• iptables: `iptables -A INPUT -s 37.221.139.97 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 37.221.139.97 drop`
• nginx: `deny 37.221.139.97;`
• pfSense: Block `37.221.139.97/32`
• Cloudflare WAF: Block IP with expression `ip.src eq 37.221.139.97`
• AWS WAF: Add IP `37.221.139.97/32` to IP set

---

## 7. Intelligence Summary

IP 37.221.139.97 represents a moderate-risk infrastructure asset associated with a legitimate radio service provider in Ukraine. While the IP itself shows no active malicious services and is classified as firewalled, its presence on 3 DNSBL lists and its neighborhood containing 4 high-risk sibling IPs warrant monitoring. The subnet exhibits mixed reputation with abuse density of 16.7%. Recommended actions include enhanced logging and consideration of blocking at network perimeters, particularly for web-facing services. The absence of persistent malicious behavior and the "mostly_clean" classification suggest this IP may be a victim of attribution errors or has been involved in low-level abuse activities in the past.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.