# 37.221.139.97 — IP Intelligence Summary 37.221.139.97 is an IPv4 address operated by Radio Service Ltd. (AS62384), geolocated to Nyzhnia Rozhanka, Ukraine. As of October 6, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/37.221.139.97 - Last updated: 2026-10-06 ## Ownership - Organization: Radio Service Ltd. - Network name: RADIOSERVICE-201712 - Allocated block: 37.221.128.0/20 - ASN: AS62384 (https://ipdebrief.com/asn/62384) - Regional registry: RIPE ## Location - City: Nyzhnia Rozhanka - Region: 46 - Country: Ukraine - Time zone: Europe/Kyiv ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (40/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP INTELLIGENCE BRIEFING: 37.221.139.97/32 **Date:** 2026-07-24 **Classification:** Moderate Risk **Risk Score:** 55/100 \--- \## 1. Ownership and Network Classification The IP address 37.221.139.97 is allocated to Radio Service Ltd. (ASN 62384), under the network block RADIOSERVICE-201712 (37.221.128.0/20). The infrastructure is geolocated to Lviv, Ukraine (UA), with a 500km accuracy radius. Network classification indicates the IP is firewalled with no active services detected (no open ports, no TLS certificates, no HTTP banner). The IP is not classified as cloud, CDN, VPN, proxy, Tor, hosting, mobile, residential, or any other special infrastructure type. **Key Data:** \- ASN: 62384 \- Organization: Radio Service Ltd. \- CIDR Block: 37.221.128.0/20 \- Location: Lviv, Ukraine \- Service Purpose: Firewalled / No Services \--- \## 2. Threat Indicators and Reputation Signals The IP registers 3 DNSBL listings out of 8 total blacklists checked. No threat indicators were identified, including no association with known campaigns, Tor exit nodes, or spam sources. However, the DNSBL listing count warrants attention as an indicator of prior abuse activity. The IP is not flagged as a known attacker. **Threat Summary:** \- DNSBL Listed: 3/8 lists \- Known Campaigns: None \- Tor Exit Node: No \- Spam Source: No \- Abuse Confidence Score: N/A \--- \## 3. Neighborhood Analysis Analysis of the /24 subnet (37.221.139.0/24) reveals 24 sibling IPs with an abuse density of 0.167 (16.7%). Risk distribution shows 4 high-risk neighbors (risk score 80), 14 medium-risk (40), and 6 low-risk (15). Notable high-risk siblings include 37.221.139.36, 37.221.139.45, 37.221.139.46, and 37.221.139.124. Only 2 threat-siblings were identified across the subnet. **Subnet Risk Profile:** \- Total Siblings: 25 \- Active Siblings: 11 \- Threat Siblings: 2 \- Abuse Density: 0.167 \- Classification: Mostly Clean (inherited risk: 3) \--- \## 4. Observation History Fifteen observations were recorded for this IP, with the most recent dated 2026-07-24. Historical signals indicate the subnet has been classified as "mostly_clean" with abuse density of 0.08. No persistent malicious behavior was detected. The IP has not changed ownership and shows no threat persistence indicators. **Historical Signals:** \- Total Observations: 15 \- Ownership Changes: 0 \- Threat Persistence Days: 0 \- Persistently Malicious: False \- Recent Classification: Mostly Clean \--- \## 5. Relationships Four relationships were identified, all pointing to the same network (RADIOSERVICE-201712). The relationship graph is limited, indicating this IP is primarily associated with its assigned network block rather than external entities such as hostnames, organizations, or certificates. \--- \## 6. Recommended Security Actions Given the elevated risk score of 55/100 and the presence of DNSBL listings, the following actions are recommended: **Immediate Actions:** \- Increase logging verbosity and review recent activity from this IP \- Consider blocking at perimeter firewall if traffic patterns are suspicious **Firewall Rules:** \- **iptables:** \`iptables -A INPUT -s 37.221.139.97 -j DROP\` \- **nftables:** \`nft add rule inet filter input ip saddr 37.221.139.97 drop\` \- **nginx:** \`deny 37.221.139.97;\` \- **pfSense:** Block \`37.221.139.97/32\` \- **Cloudflare WAF:** Block IP with expression \`ip.src eq 37.221.139.97\` \- **AWS WAF:** Add IP \`37.221.139.97/32\` to IP set \--- \## 7. Intelligence Summary IP 37.221.139.97 represents a moderate-risk infrastructure asset associated with a legitimate radio service provider in Ukraine. While the IP itself shows no active malicious services and is classified as firewalled, its presence on 3 DNSBL lists and its neighborhood containing 4 high-risk sibling IPs warrant monitoring. The subnet exhibits mixed reputation with abuse density of 16.7%. Recommended actions include enhanced logging and consideration of blocking at network perimeters, particularly for web-facing services. The absence of persistent malicious behavior and the "mostly_clean" classification suggest this IP may be a victim of attribution errors or has been involved in low-level abuse activities in the past. ## Nearby addresses - 37.221.139.8 (https://ipdebrief.com/37.221.139.8) - 37.221.139.12 (https://ipdebrief.com/37.221.139.12) - 37.221.139.15 (https://ipdebrief.com/37.221.139.15) - 37.221.139.20 (https://ipdebrief.com/37.221.139.20) - 37.221.139.36 (https://ipdebrief.com/37.221.139.36) - 37.221.139.37 (https://ipdebrief.com/37.221.139.37) - 37.221.139.45 (https://ipdebrief.com/37.221.139.45) - 37.221.139.46 (https://ipdebrief.com/37.221.139.46) - 37.221.139.62 (https://ipdebrief.com/37.221.139.62) - 37.221.139.69 (https://ipdebrief.com/37.221.139.69) - 37.221.139.74 (https://ipdebrief.com/37.221.139.74) - 37.221.139.77 (https://ipdebrief.com/37.221.139.77) --- Source: IPDebrief, "37.221.139.97 IP intelligence", https://ipdebrief.com/37.221.139.97, updated 2026-10-06. Assessments are probabilistic.