# 37.221.159.136 — IP Intelligence Summary 37.221.159.136 is an IPv4 address operated by Radio Service Ltd. (AS62384), geolocated to Lviv, Ukraine. As of October 7, 2026, IPDebrief rates it High Risk (80/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/37.221.159.136 - Last updated: 2026-10-07 ## Ownership - Organization: Radio Service Ltd. - Network name: RADIOSERVICE-201801 - Allocated block: 37.221.144.0/20 - ASN: AS62384 (https://ipdebrief.com/asn/62384) - Regional registry: RIPE ## Location - City: Lviv - Region: 46 - Country: Ukraine - Time zone: Europe/Kyiv ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: High Risk (80/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Exposed services - 22/tcp — ssh ## Analyst narrative \# IP Intelligence Briefing: 37.221.159.136 \## Executive Summary Target IP 37.221.159.136 presents a **moderate risk profile (score: 55/100)** with geolocation inconsistencies and evidence of DNSBL listings. The IP is located in Warsaw, Poland (ASN 62384), operates in a subnet with elevated abuse density (10.8%), and shows no active services or threat indicators. Recommended action: **monitor with enhanced logging** or **block** depending on organizational policy. \--- \## Profile Overview | Attribute | Value | |-----------|-------| | **Risk Score** | 55/100 (Moderate Risk) | | **Geolocation** | Warsaw, Poland (PL) | | **ASN** | 62384 | | **BGP Prefix** | 37.221.144.0/20 | | **Network Role** | Firewalled / No Services | | **DNSBL Listed** | 3/8 lists | | **Operator Score** | 0.1304 (Minimal) | | **RPKI State** | Not verified | \### Threat Indicators \- **Known Attacker**: No \- **Tor Exit Node**: No \- **Spam Source**: No \- **Blacklist Count**: 0 (profile-level), but 3 DNSBL entries detected \- **Active Threats**: None detected \--- \## Network Services & Fingerprinting \- **Open Ports**: None detected \- **TLS Certificate**: None \- **HTTP Title**: None \- **Hosted Domains**: 0 \- **Email Auth Records**: None (SPF/DMARC not configured) \- **Service Purpose**: Firewalled / No Services \--- \## Geolocation Validation \- **Primary Location**: Warsaw, Poland (PL) \- **Timezone**: Europe/Warsaw \- **GeoConsensus**: False (inconsistent data sources) \- **Geo Plausibility**: False \- **Traceroute**: 13 hops; first hop RTT 0.2ms; last hop RTT 136.2ms; transit via Comcast \- **Note**: Recent observation (2026-07-27) showed conflicting geolocation data indicating Ukraine, suggesting potential routing anomalies or multi-homed infrastructure. \--- \## Neighborhood Analysis (37.221.159.0/24) \- **Total Subnet Size**: 256 IPs \- **Abuse Density**: 10.8% (elevated) \- **Classification**: Mostly clean \- **Risk Distribution**: \- High Risk: 4 IPs \- Medium Risk: 25 IPs \- Low Risk: 7 IPs \### High-Risk Neighbors (Risk Score ≥ 80) \- 37.221.159.41 (80) \- 37.221.159.88 (80) \- 37.221.159.175 (80) \- 37.221.159.194 (80) \### Medium-Risk Neighbors (Risk Score 55-65) Multiple IPs including 37.221.159.136 (55), 37.221.159.82 (65), and 37.221.159.145 (40). \--- \## Observation History Total observations: 11 (as of 2026-07-27) **Recent Signals:** \- **2026-07-27 02:42:13**: Traceroute to target reached (13 hops) \- **2026-07-27 02:41:38**: Geolocation reported Ukraine (confidence 0.70) \- **2026-07-27 02:41:26**: Subnet abuse density 0.0526, classification "mostly_clean" \- **2026-07-27 02:40:32**: Operator score 0.1304 (Minimal) **Temporal Indicators:** \- Ownership changes: 0 \- Threat observation count: 0 \- Persistently malicious: No \- Threat persistence days: 0 \--- \## Relationship Graph \- **Related Entities**: None detected \- **Subnets**: None \- **Hostnames**: None \- **Organizations**: None \- **Certificates**: None \--- \## Recommended Security Actions \### Monitoring (High Priority) \- Increase logging verbosity for traffic from this IP \- Review recent activity patterns \### Firewall Rules \- **iptables**: \`iptables -A INPUT -s 37.221.159.136 -j DROP\` \- **nftables**: \`nft add rule inet filter input ip saddr 37.221.159.136 drop\` \- **nginx**: \`deny 37.221.159.136;\` \- **pfSense**: Add 37.221.159.136/32 to block list \- **Cloudflare WAF**: Block expression: \`ip.src eq 37.221.159.136\` \- **AWS WAF**: Address: 37.221.159.136/32 \### Rationale Elevated risk score (55/100) combined with neighborhood abuse density (10.8%) and DNSBL listings warrant defensive measures. No services are actively running, suggesting passive presence or reconnaissance posture. \--- \## Intelligence Assessment IP 37.221.159.136 exhibits moderate risk characteristics with no active threat indicators. The subnet shows elevated abuse density, suggesting this infrastructure may be associated with compromised entities or misconfigured services. Geolocation inconsistencies require ongoing monitoring. The absence of open services and threat indicators suggests this IP may represent dormant infrastructure or a passive presence. **Threat Level**: MODERATE **Recommended Action**: Monitor or Block based on organizational risk tolerance **Confidence**: Medium (based on neighborhood context and DNSBL listings) ## Nearby addresses - 37.221.159.14 (https://ipdebrief.com/37.221.159.14) - 37.221.159.21 (https://ipdebrief.com/37.221.159.21) - 37.221.159.22 (https://ipdebrief.com/37.221.159.22) - 37.221.159.31 (https://ipdebrief.com/37.221.159.31) - 37.221.159.33 (https://ipdebrief.com/37.221.159.33) - 37.221.159.36 (https://ipdebrief.com/37.221.159.36) - 37.221.159.41 (https://ipdebrief.com/37.221.159.41) - 37.221.159.43 (https://ipdebrief.com/37.221.159.43) - 37.221.159.52 (https://ipdebrief.com/37.221.159.52) - 37.221.159.54 (https://ipdebrief.com/37.221.159.54) - 37.221.159.63 (https://ipdebrief.com/37.221.159.63) - 37.221.159.66 (https://ipdebrief.com/37.221.159.66) --- Source: IPDebrief, "37.221.159.136 IP intelligence", https://ipdebrief.com/37.221.159.136, updated 2026-10-07. Assessments are probabilistic.