# 172.98.33.198 — IP Intelligence Summary 172.98.33.198 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/172.98.33.198 - Last updated: 2026-10-06 ## Ownership - Organization: Prefixx, Inc. - Network name: PFX-EXPRESSVPN - Allocated block: 172.98.32.0/23 - ASN: AS396356 (https://ipdebrief.com/asn/396356) - Regional registry: ARIN ## Location - City: Dallas - Region: TX - Country: United States - Time zone: America/Chicago ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 172.98.33.198/32 \## Executive Summary IP address 172.98.33.198 presents a low-risk profile with a risk score of 25. The address belongs to Prefixx, Inc. (AS396356) under the PFX-EXPRESSVPN network block (172.98.32.0/23). Current observations indicate the IP is currently firewalled with no active services, and no known threat indicators have been detected. \## Ownership and Registration \- **Organization:** Prefixx, Inc. \- **Network Name:** PFX-EXPRESSVPN \- **ASN:** 396356 \- **CIDR Block:** 172.98.32.0/23 \- **RIR:** ARIN \- **Abuse Contact:** abuse-reports@vpnconsumer.com \- **Location:** United States, Texas, Dallas (geo consensus confirmed) \## Risk Assessment | Metric | Value | |--------|-------| | Risk Score | 25 (Low Risk) | | Reputation | Low Risk | | Provider Score | 0 | | Authority Score | 0 | | Operator Score | 0.1304 (Minimal) | | Abuse Confidence | Not elevated | The IP is not classified as a Tor exit node, known attacker, or spam source. Blacklist count remains at zero, though one DNSBL listing was observed out of eight total lists checked. \## Network Status and Services \- **Network Role:** Firewalled / No Services \- **Open Ports:** None detected \- **TLS Certificate:** None \- **HTTP Service:** None \- **DNS PTR Records:** None \- **Forward Resolution:** Not confirmed \- **Hosted Domains:** Zero The address appears to be in a dormant or firewalled state with no publicly accessible services. \## Neighborhood Analysis **Subnet:** 172.98.33.0/24 \- **Total Siblings:** 107 \- **Active Siblings:** 53 \- **Threat Siblings:** 16 \- **Abuse Density:** 0.1495 \- **Classification:** Mostly Clean Risk distribution within the /24 subnet: \- High Risk: 0 IPs \- Medium Risk: 1 IP \- Low Risk: 99 IPs The neighborhood demonstrates minimal abuse concentration, with the target IP's immediate neighbors showing predominantly low-risk profiles (risk score 0). \## Threat Indicators \- **Active Threats:** None detected \- **Campaign Associations:** None \- **Known Malicious Activity:** None \- **Honeypot Hits:** 0 \- **Enumeration Strikes:** 0 \- **WAF Violations:** 0 \- **Total Incidents:** 0 \## Network Path Analysis \- **Traceroute Hops:** 16 \- **First Hop RTT:** 0.1ms \- **Last Hop RTT:** 62.9ms \- **Timed Out Hops:** 5 \- **Transit Network:** Comcast \## Temporal Intelligence \- **Ownership Changes:** 0 \- **Threat Persistence Days:** 0 \- **Threat Observation Count:** 0 \- **Persistent Malicious Indicator:** False The IP shows no signs of persistent malicious behavior over the observation period. \## Recommended Actions No specific security actions or firewall rules are currently recommended based on the IP's risk profile. The address presents a low-risk profile suitable for standard monitoring practices. However, the following considerations apply: 1. **DNSBL Monitoring:** One DNSBL listing detected; monitor for changes if this IP begins generating outbound traffic. 2. **Subnet Awareness:** While the target IP is low-risk, 16 threat-sibling IPs exist within the /24 subnet. Monitor for lateral threat activity. 3. **Service Activity:** No services currently detected; if services are subsequently observed, reassess threat posture. \## Intelligence Narrative The IP address 172.98.33.198 is a dormant infrastructure asset belonging to Prefixx, Inc.'s PFX-EXPRESSVPN network. Current telemetry indicates the address is firewalled with no active services or detected threat indicators. The subnet environment demonstrates minimal abuse concentration, with 99% of sibling IPs classified as low-risk. Historical data shows no persistent malicious behavior or ownership changes. While no immediate blocking action is warranted, standard monitoring procedures should continue, particularly regarding the subnet's 16 known threat siblings. The IP is suitable for passive traffic observation without active defensive measures. ## Nearby addresses - 172.98.33.4 (https://ipdebrief.com/172.98.33.4) - 172.98.33.5 (https://ipdebrief.com/172.98.33.5) - 172.98.33.6 (https://ipdebrief.com/172.98.33.6) - 172.98.33.7 (https://ipdebrief.com/172.98.33.7) - 172.98.33.8 (https://ipdebrief.com/172.98.33.8) - 172.98.33.9 (https://ipdebrief.com/172.98.33.9) - 172.98.33.11 (https://ipdebrief.com/172.98.33.11) - 172.98.33.12 (https://ipdebrief.com/172.98.33.12) - 172.98.33.13 (https://ipdebrief.com/172.98.33.13) - 172.98.33.14 (https://ipdebrief.com/172.98.33.14) - 172.98.33.15 (https://ipdebrief.com/172.98.33.15) - 172.98.33.16 (https://ipdebrief.com/172.98.33.16) --- Source: IPDebrief, "172.98.33.198 IP intelligence", https://ipdebrief.com/172.98.33.198, updated 2026-10-06. Assessments are probabilistic.