172.98.33.198📋 Copy

# IP Intelligence Briefing: 172.98.33.198/32

## Executive Summary

IP address 172.98.33.198 presents a low-risk profile with a risk score of 25. The address belongs to Prefixx, Inc. (AS396356) under the PFX-EXPRESSVPN network block (172.98.32.0/23). Current observations indicate the IP is currently firewalled with no active services, and no known threat indicators have been detected.

## Ownership and Registration

• Organization: Prefixx, Inc.
• Network Name: PFX-EXPRESSVPN
• ASN: 396356
• CIDR Block: 172.98.32.0/23
• RIR: ARIN
• Abuse Contact: abuse-reports@vpnconsumer.com
• Location: United States, Texas, Dallas (geo consensus confirmed)

## Risk Assessment

The IP is not classified as a Tor exit node, known attacker, or spam source. Blacklist count remains at zero, though one DNSBL listing was observed out of eight total lists checked.

## Network Status and Services

• Network Role: Firewalled / No Services
• Open Ports: None detected
• TLS Certificate: None
• HTTP Service: None
• DNS PTR Records: None
• Forward Resolution: Not confirmed
• Hosted Domains: Zero

The address appears to be in a dormant or firewalled state with no publicly accessible services.

## Neighborhood Analysis

Subnet: 172.98.33.0/24

• Total Siblings: 107
• Active Siblings: 53
• Threat Siblings: 16
• Abuse Density: 0.1495
• Classification: Mostly Clean

Risk distribution within the /24 subnet:

• High Risk: 0 IPs
• Medium Risk: 1 IP
• Low Risk: 99 IPs

The neighborhood demonstrates minimal abuse concentration, with the target IP's immediate neighbors showing predominantly low-risk profiles (risk score 0).

## Threat Indicators

• Active Threats: None detected
• Campaign Associations: None
• Known Malicious Activity: None
• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0

## Network Path Analysis

• Traceroute Hops: 16
• First Hop RTT: 0.1ms
• Last Hop RTT: 62.9ms
• Timed Out Hops: 5
• Transit Network: Comcast

## Temporal Intelligence

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistent Malicious Indicator: False

The IP shows no signs of persistent malicious behavior over the observation period.

## Recommended Actions

No specific security actions or firewall rules are currently recommended based on the IP's risk profile. The address presents a low-risk profile suitable for standard monitoring practices. However, the following considerations apply:

1. DNSBL Monitoring: One DNSBL listing detected; monitor for changes if this IP begins generating outbound traffic.

2. Subnet Awareness: While the target IP is low-risk, 16 threat-sibling IPs exist within the /24 subnet. Monitor for lateral threat activity.

3. Service Activity: No services currently detected; if services are subsequently observed, reassess threat posture.

## Intelligence Narrative

The IP address 172.98.33.198 is a dormant infrastructure asset belonging to Prefixx, Inc.'s PFX-EXPRESSVPN network. Current telemetry indicates the address is firewalled with no active services or detected threat indicators. The subnet environment demonstrates minimal abuse concentration, with 99% of sibling IPs classified as low-risk. Historical data shows no persistent malicious behavior or ownership changes. While no immediate blocking action is warranted, standard monitoring procedures should continue, particularly regarding the subnet's 16 known threat siblings. The IP is suitable for passive traffic observation without active defensive measures.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.