172.98.33.200📋 Copy

# IP INTELLIGENCE BRIEFING

Target: 172.98.33.200/32

Classification: Low Risk / VPN Infrastructure

Date: 2026-07-28

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 172.98.33.200 is associated with PFX-EXPRESSVPN (AS396356, Prefixx, Inc.) and presents a low-to-moderate risk profile (Risk Score: 25). The IP belongs to an ExpressVPN service network with geolocation consensus pointing to Newark, NJ, US. Despite the overall low-risk classification, historical observations indicate threat-related signal activity on 2026-07-28, including one detected threat pulse. The IP shows no active open ports and is classified as firewalled with no services exposed.

---

## RISK ASSESSMENT

Risk Breakdown: The IP maintains a low risk score despite being associated with a VPN provider. The single DNSBL listing represents approximately 12.5% of total lists checked, suggesting minimal but non-zero reputation concerns.

---

## NETWORK ATTRIBUTES

---

## THREAT OBSERVATIONS

Current Threat Indicators

• Threat Indicators: None currently active
• Known Campaigns: None
• Threat Feeds: Empty
• Campaign Likelihood: Not applicable

Historical Signal Activity (14 observations)

Recent activity concentrated on 2026-07-28:

• Threat Signal: One pulse detected via AlienVault OTX
• DNS Signals: DNSSEC validation confirmed (zone: 200.33.98.172.in-addr.arpa)
• ASN Resolution: Confirmed AS396356 (LATITUDE-SH, US)
• PTR Records: None (no reverse DNS)

Temporal Analysis:

• Ownership changes: 0
• Threat persistence days: 0
• Threat observation count: 1
• Persistently malicious: False

---

## NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 172.98.33.200/24

Neighborhood Classification: The /24 subnet demonstrates minimal abuse activity. The target IP sits within a predominantly clean neighborhood (99% low-risk), suggesting the IP's risk profile is isolated rather than part of a broader compromised subnet.

---

## TECHNICAL SERVICES

---

## CONTROL PLANE DATA

---

## TRACEROUTE ANALYSIS

• Hop Count: 17
• First Hop RTT: 0.3ms
• Last Hop RTT: 59.9ms
• Timed Out Hops: 3
• Primary Transit: Comcast

---

## SECURITY RECOMMENDATIONS

Current Status

No automated security actions or firewall rules generated. Risk Score of 25 indicates low immediate threat.

Recommended Actions for SOC

1. Monitor Closely: Despite low overall risk, the recent threat pulse (2026-07-28) warrants continued observation

2. Contextualize: If this IP appears in your traffic, evaluate based on network policy for VPN/expression IP ranges

3. No Immediate Blocking: Current risk profile does not justify blocking without additional context

4. Correlate with Known Threat Intel: Cross-reference with internal threat feeds for any associated malicious activity

---

## CONCLUSION

IP 172.98.33.200 is a VPN infrastructure address (ExpressVPN/PFX-EXPRESSVPN) with low-risk characteristics. The single historical threat signal and minimal DNSBL presence suggest limited but non-zero reputation concerns. The IP shows no active services or open ports, indicating proper firewall hardening. Network neighborhood analysis confirms the subnet maintains a clean abuse profile.

Disposition: LOW RISK — No immediate action required. Continue monitoring for threat signal changes.

---

*Generated by IPDebrief Intelligence Platform*

*All data sourced from real-time IPDebrief threat intelligence feeds*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.