# 172.98.33.199 — IP Intelligence Summary 172.98.33.199 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of September 2, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/172.98.33.199 - Last updated: 2026-09-02 ## Ownership - Organization: Prefixx, Inc. - Network name: PFX-EXPRESSVPN - Allocated block: 172.98.32.0/23 - ASN: AS396356 (https://ipdebrief.com/asn/396356) - Regional registry: ARIN ## Location - City: Dallas - Region: Texas - Country: United States - Time zone: — ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 172.98.33.199/32 **Classification:** Low Risk **Date of Analysis:** 2026-07-28 **Analyst:** IPDebrief Intelligence Unit \--- \## Executive Summary IP address 172.98.33.199 belongs to Prefixx, Inc. (AS396356) under the PFX-EXPRESSVPN network block (172.98.32.0/23). The address presents a low-risk profile with a risk score of 25/100. However, geolocation inconsistencies and one medium-risk neighbor in the /24 subnet warrant continued monitoring. \--- \## Ownership & Network Classification | Attribute | Value | |-----------|-------| | **Organization** | Prefixx, Inc. | | **Netname** | PFX-EXPRESSVPN | | **ASN** | 396356 | | **CIDR Block** | 172.98.32.0/23 | | **Location** | Dallas, Texas, US | | **Network Role** | Firewalled / No Services | The IP operates under a VPN provider infrastructure. No services are currently open on this host, and no TLS certificates or HTTP titles were detected during probing. \--- \## Threat Indicators & Reputation \- **Risk Score:** 25/100 (Low Risk) \- **Blacklist Count:** 0 \- **Known Attacker:** No \- **Tor Exit Node:** No \- **Spam Source:** No \- **DNSBL Listed:** 1 of 8 total lists \- **Abuse Confidence Score:** Not applicable No active threat indicators or known campaign associations were identified. The IP does not appear in major threat feeds. \--- \## Geolocation Validation Alert **⚠️ GEOLOCATION ANOMALY DETECTED** Multiple observations indicate a significant geolocation discrepancy: \- **Claimed Location:** Dallas, Texas, US (32.79°N, 96.83°W) \- **Claimed Distance:** 7,998.3 km \- **Observed RTT:** 62ms (minimum possible: 160ms for that distance) The RTT violation suggests either: 1. Geolocation data is inaccurate or spoofed 2. The IP is not actually located in the claimed region 3. Network path issues or routing anomalies This discrepancy requires validation through additional intelligence sources before operational decisions. \--- \## Historical Observations **Total Observations:** 16 signals captured Key recent findings (2026-07-28): \- Ownership changes: 0 (stable ownership) \- Traceroute: 18 hops to target, reached successfully \- AlienVault OTX: Reputation score 0, has_threats flag active with 1 pulse \- Multiple geolocation signals with inconsistent location data Threat persistence days: 0 Threat observation count: 0 Is persistently malicious: No \--- \## Network Neighborhood Analysis **Subnet:** 172.98.33.0/24 **Total Neighbors Analyzed:** 100 | Risk Category | Count | Percentage | |---------------|-------|------------| | High Risk | 0 | 0% | | Medium Risk | 1 | 1% | | Low Risk | 99 | 99% | **Abuse Density:** 0 **Inherited Risk:** 0 The /24 subnet shows minimal abuse activity with only one medium-risk neighbor detected. Most sibling IPs (172.98.33.5, 172.98.33.6, 172.98.33.8, etc.) maintain low-risk profiles. \--- \## Relationships & Campaign Correlation **Related Entities:** 3 relationships identified \- All relationships link to "PFX-EXPRESSVPN" network infrastructure **Campaign Indicators:** \- Campaign likelihood: Not applicable \- Certificate matches: 0 \- Banner matches: 0 \- Correlated IPs: 0 No certificate-based or banner-based campaign associations detected. \--- \## Recommended Security Actions Based on the low-risk profile and firewalled status: 1. **Allow Traffic:** No immediate blocking recommended 2. **Monitor Geolocation:** Validate actual location through additional means 3. **Watch Neighbors:** Monitor the one medium-risk neighbor in the /24 subnet 4. **Routine Review:** Standard review cycle recommended given VPN provider nature \--- \## Conclusion IP 172.98.33.199 maintains a low-risk profile consistent with its VPN provider classification. The geolocation discrepancy is the primary concern and should be validated. No immediate threat indicators require defensive action. Continue routine monitoring of the subnet, particularly the one medium-risk neighbor. **Status:** Monitor **Priority:** Low ## Nearby addresses - 172.98.33.4 (https://ipdebrief.com/172.98.33.4) - 172.98.33.5 (https://ipdebrief.com/172.98.33.5) - 172.98.33.6 (https://ipdebrief.com/172.98.33.6) - 172.98.33.7 (https://ipdebrief.com/172.98.33.7) - 172.98.33.8 (https://ipdebrief.com/172.98.33.8) - 172.98.33.9 (https://ipdebrief.com/172.98.33.9) - 172.98.33.11 (https://ipdebrief.com/172.98.33.11) - 172.98.33.12 (https://ipdebrief.com/172.98.33.12) - 172.98.33.13 (https://ipdebrief.com/172.98.33.13) - 172.98.33.14 (https://ipdebrief.com/172.98.33.14) - 172.98.33.15 (https://ipdebrief.com/172.98.33.15) - 172.98.33.16 (https://ipdebrief.com/172.98.33.16) --- Source: IPDebrief, "172.98.33.199 IP intelligence", https://ipdebrief.com/172.98.33.199, updated 2026-09-02. Assessments are probabilistic.