37.221.150.172📋 Copy

## IP Intelligence Briefing: 37.221.150.172/32

Executive Summary

Target IP 37.221.150.172 is assigned to Radio Service Ltd. (ASN 62384) within the 37.221.144.0/20 block, originating from Lviv, Ukraine. Current risk assessment: LOW (Score: 30). The IP presents as firewalled with no active services, though the hosting subnet exhibits moderate abuse density (0.143).

---

Ownership & Registration

• Organization: Radio Service Ltd.
• Network Name: RADIOSERVICE-201801
• ASN: 62384
• CIDR Block: 37.221.144.0/20
• RIR: RIPE
• Abuse Contact: abuse@radioservice.net.ua
• Geolocation: Lviv, Ukraine (50.45°N, 30.53°E)

---

Threat Profile

• Overall Risk Score: 30/100 (Low Risk)
• Risk Category: Low Risk
• Abuse Confidence Score: Not calculated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 2 DNSBL listings out of 8 total checks
• Max Severity: Medium

---

Network & Service Status

• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• TLS Certificates: None
• DNS PTR Records: None
• Forward Resolution: Not confirmed
• Route Stability: False (network experienced BGP changes)
• Operator Score: 0.1304 (Minimal)

---

Subnet Analysis (37.221.150.0/24)

• Total Neighbors: 21 IPs
• Abuse Density: 0.143 (Moderate)
• Risk Distribution:

- High Risk (80): 3 IPs

- Medium Risk (40-55): 10 IPs

- Low Risk (15-30): 8 IPs

• Target IP Classification: Low-tier risk within subnet

---

Historical Observations

Ten observations recorded since deployment. Recent activity (2026-07-30) shows:

• Consistent Geolocation: Ukraine (Lviv) across all probes
• Organization Resolution: Radio Service Ltd. confirmed
• Threat Listings: 2 DNSBL listings with medium severity
• Service Status: No open ports or banners detected in historical scans
• Persistence: No persistent malicious behavior observed

---

Relationship Graph

• Identified Relationships: 2
• Type: Same Network (RADIOSERVICE-201801)
• External Connections: None to hostnames, organizations, or certificates

---

Recommended Actions

Current Risk Level: LOW

Defensive Posture:

• Standard monitoring recommended; no immediate blocking required
• Monitor for changes in DNSBL listings
• Track BGP route stability changes in ASN 62384
• Investigate if any subnet neighbors (37.221.150.5, .9, .146, .177, .194, .196, .244) show elevated activity

Firewall Rule Consideration:

• No blocking action currently warranted
• Whitelist acceptable given legitimate organization assignment
• Monitor for behavioral anomalies consistent with subnet abuse patterns

---

Intelligence Notes

The IP belongs to a legitimate radio service organization but operates within a subnet showing moderate abuse density. While the target IP itself shows no active threat indicators, SOC analysts should monitor the broader 37.221.150.0/24 subnet for correlated malicious activity, particularly the three high-risk neighbors (37.221.150.146, .177, .194) which may indicate broader network compromise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.