172.98.33.199📋 Copy

# IP Intelligence Briefing: 172.98.33.199/32

Classification: Low Risk

Date of Analysis: 2026-07-28

Analyst: IPDebrief Intelligence Unit

---

## Executive Summary

IP address 172.98.33.199 belongs to Prefixx, Inc. (AS396356) under the PFX-EXPRESSVPN network block (172.98.32.0/23). The address presents a low-risk profile with a risk score of 25/100. However, geolocation inconsistencies and one medium-risk neighbor in the /24 subnet warrant continued monitoring.

---

## Ownership & Network Classification

The IP operates under a VPN provider infrastructure. No services are currently open on this host, and no TLS certificates or HTTP titles were detected during probing.

---

## Threat Indicators & Reputation

• Risk Score: 25/100 (Low Risk)
• Blacklist Count: 0
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• DNSBL Listed: 1 of 8 total lists
• Abuse Confidence Score: Not applicable

No active threat indicators or known campaign associations were identified. The IP does not appear in major threat feeds.

---

## Geolocation Validation Alert

⚠️ GEOLOCATION ANOMALY DETECTED

Multiple observations indicate a significant geolocation discrepancy:

• Claimed Location: Dallas, Texas, US (32.79°N, 96.83°W)
• Claimed Distance: 7,998.3 km
• Observed RTT: 62ms (minimum possible: 160ms for that distance)

The RTT violation suggests either:

1. Geolocation data is inaccurate or spoofed

2. The IP is not actually located in the claimed region

3. Network path issues or routing anomalies

This discrepancy requires validation through additional intelligence sources before operational decisions.

---

## Historical Observations

Total Observations: 16 signals captured

Key recent findings (2026-07-28):

• Ownership changes: 0 (stable ownership)
• Traceroute: 18 hops to target, reached successfully
• AlienVault OTX: Reputation score 0, has_threats flag active with 1 pulse
• Multiple geolocation signals with inconsistent location data

Threat persistence days: 0

Threat observation count: 0

Is persistently malicious: No

---

## Network Neighborhood Analysis

Subnet: 172.98.33.0/24

Total Neighbors Analyzed: 100

Abuse Density: 0

Inherited Risk: 0

The /24 subnet shows minimal abuse activity with only one medium-risk neighbor detected. Most sibling IPs (172.98.33.5, 172.98.33.6, 172.98.33.8, etc.) maintain low-risk profiles.

---

## Relationships & Campaign Correlation

Related Entities: 3 relationships identified

• All relationships link to "PFX-EXPRESSVPN" network infrastructure

Campaign Indicators:

• Campaign likelihood: Not applicable
• Certificate matches: 0
• Banner matches: 0
• Correlated IPs: 0

No certificate-based or banner-based campaign associations detected.

---

## Recommended Security Actions

Based on the low-risk profile and firewalled status:

1. Allow Traffic: No immediate blocking recommended

2. Monitor Geolocation: Validate actual location through additional means

3. Watch Neighbors: Monitor the one medium-risk neighbor in the /24 subnet

4. Routine Review: Standard review cycle recommended given VPN provider nature

---

## Conclusion

IP 172.98.33.199 maintains a low-risk profile consistent with its VPN provider classification. The geolocation discrepancy is the primary concern and should be validated. No immediate threat indicators require defensive action. Continue routine monitoring of the subnet, particularly the one medium-risk neighbor.

Status: Monitor

Priority: Low

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.