# 172.98.33.200 — IP Intelligence Summary

172.98.33.200 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of September 2, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/172.98.33.200
- Last updated: 2026-09-02

## Ownership

- Organization: Prefixx, Inc.
- Network name: PFX-EXPRESSVPN
- Allocated block: 172.98.32.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: ARIN

## Location

- City: Dallas
- Region: TX
- Country: United States
- Time zone: America/Chicago

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target:** 172.98.33.200/32

**Classification:** Low Risk / VPN Infrastructure

**Date:** 2026-07-28

**Analyst:** IPDebrief Intelligence Team

\---

\## EXECUTIVE SUMMARY

IP address 172.98.33.200 is associated with **PFX-EXPRESSVPN** (AS396356, Prefixx, Inc.) and presents a low-to-moderate risk profile (Risk Score: 25). The IP belongs to an ExpressVPN service network with geolocation consensus pointing to Newark, NJ, US. Despite the overall low-risk classification, historical observations indicate threat-related signal activity on 2026-07-28, including one detected threat pulse. The IP shows no active open ports and is classified as firewalled with no services exposed.

\---

\## RISK ASSESSMENT

| Metric | Value |

|--------|-------|

| **Overall Risk Score** | 25 (Low Risk) |

| **Provider Score** | 0 |

| **Authority Score** | 0 |

| **Abuse Confidence** | Not applicable |

| **Blacklist Count** | 0 (current) |

| **DNSBL Listings** | 1 of 8 total lists |

| **Known Attacker** | No |

| **Spam Source** | No |

| **Tor Exit Node** | No |

**Risk Breakdown:** The IP maintains a low risk score despite being associated with a VPN provider. The single DNSBL listing represents approximately 12.5% of total lists checked, suggesting minimal but non-zero reputation concerns.

\---

\## NETWORK ATTRIBUTES

| Attribute | Value |

|-----------|-------|

| **Organization** | Prefixx, Inc. |

| **ASN** | AS396356 |

| **Network Name** | PFX-EXPRESSVPN |

| **CIDR Block** | 172.98.32.0/23 |

| **Geolocation** | Newark, NJ, US (US-NJ) |

| **Timezone** | America/New_York |

| **Geo Consensus** | True |

| **Geo Plausible** | False |

| **ISP** | maxihost llc / LATITUDE-SH |

| **Network Role** | Firewalled / No Services |

| **Cloud/CDN/Proxy** | No |

\---

\## THREAT OBSERVATIONS

\### Current Threat Indicators

\- **Threat Indicators:** None currently active

\- **Known Campaigns:** None

\- **Threat Feeds:** Empty

\- **Campaign Likelihood:** Not applicable

\### Historical Signal Activity (14 observations)

Recent activity concentrated on 2026-07-28:

\- **Threat Signal:** One pulse detected via AlienVault OTX

\- **DNS Signals:** DNSSEC validation confirmed (zone: 200.33.98.172.in-addr.arpa)

\- **ASN Resolution:** Confirmed AS396356 (LATITUDE-SH, US)

\- **PTR Records:** None (no reverse DNS)

**Temporal Analysis:**

\- Ownership changes: 0

\- Threat persistence days: 0

\- Threat observation count: 1

\- Persistently malicious: False

\---

\## NETWORK NEIGHBORHOOD ANALYSIS

**Subnet:** 172.98.33.200/24

| Metric | Value |

|--------|-------|

| **Total Siblings** | 100 |

| **Abuse Density** | 0 |

| **High-Risk Neighbors** | 0 |

| **Medium-Risk Neighbors** | 1 |

| **Low-Risk Neighbors** | 99 |

**Neighborhood Classification:** The /24 subnet demonstrates minimal abuse activity. The target IP sits within a predominantly clean neighborhood (99% low-risk), suggesting the IP's risk profile is isolated rather than part of a broader compromised subnet.

\---

\## TECHNICAL SERVICES

| Service Category | Status |

|------------------|--------|

| **Open Ports** | None detected |

| **TLS Certificate** | Not detected |

| **HTTP Title** | Not detected |

| **Server Banner** | Not detected |

| **Hosted Domains** | 0 |

| **Email Auth (SPF/DMARC)** | N/A |

| **Forward Resolution** | 0 hosts |

\---

\## CONTROL PLANE DATA

| Metric | Value |

|--------|-------|

| **Origin ASN** | AS396356 |

| **BGP Prefix** | 172.98.33.0/24 |

| **Route Stability** | False |

| **Route Changes (30d)** | 0 |

| **RPKI State** | Not assessed |

| **IRR Consistency** | Not assessed |

| **MoAS** | False |

| **DNSSEC Valid** | True |

| **CAA Records** | None |

\---

\## TRACEROUTE ANALYSIS

\- **Hop Count:** 17

\- **First Hop RTT:** 0.3ms

\- **Last Hop RTT:** 59.9ms

\- **Timed Out Hops:** 3

\- **Primary Transit:** Comcast

\---

\## SECURITY RECOMMENDATIONS

\### Current Status

No automated security actions or firewall rules generated. Risk Score of 25 indicates low immediate threat.

\### Recommended Actions for SOC

1. **Monitor Closely:** Despite low overall risk, the recent threat pulse (2026-07-28) warrants continued observation

2. **Contextualize:** If this IP appears in your traffic, evaluate based on network policy for VPN/expression IP ranges

3. **No Immediate Blocking:** Current risk profile does not justify blocking without additional context

4. **Correlate with Known Threat Intel:** Cross-reference with internal threat feeds for any associated malicious activity

\---

\## CONCLUSION

IP 172.98.33.200 is a VPN infrastructure address (ExpressVPN/PFX-EXPRESSVPN) with low-risk characteristics. The single historical threat signal and minimal DNSBL presence suggest limited but non-zero reputation concerns. The IP shows no active services or open ports, indicating proper firewall hardening. Network neighborhood analysis confirms the subnet maintains a clean abuse profile.

**Disposition:** LOW RISK — No immediate action required. Continue monitoring for threat signal changes.

\---

*Generated by IPDebrief Intelligence Platform*

*All data sourced from real-time IPDebrief threat intelligence feeds*

## Nearby addresses

- 172.98.33.4 (https://ipdebrief.com/172.98.33.4)
- 172.98.33.5 (https://ipdebrief.com/172.98.33.5)
- 172.98.33.6 (https://ipdebrief.com/172.98.33.6)
- 172.98.33.7 (https://ipdebrief.com/172.98.33.7)
- 172.98.33.8 (https://ipdebrief.com/172.98.33.8)
- 172.98.33.9 (https://ipdebrief.com/172.98.33.9)
- 172.98.33.11 (https://ipdebrief.com/172.98.33.11)
- 172.98.33.12 (https://ipdebrief.com/172.98.33.12)
- 172.98.33.13 (https://ipdebrief.com/172.98.33.13)
- 172.98.33.14 (https://ipdebrief.com/172.98.33.14)
- 172.98.33.15 (https://ipdebrief.com/172.98.33.15)
- 172.98.33.16 (https://ipdebrief.com/172.98.33.16)

---

Source: IPDebrief, "172.98.33.200 IP intelligence", https://ipdebrief.com/172.98.33.200, updated 2026-09-02. Assessments are probabilistic.