172.98.33.217
172.98.33.217 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.
# IP INTELLIGENCE BRIEFING
Subject: 172.98.33.217/32
Classification: Low Risk / Passive
Generated: 2026-07-29
Status: Complete Analysis
---
## EXECUTIVE SUMMARY
IP address 172.98.33.217 belongs to Prefixx, Inc. (ASN 396356) and operates within the PFX-EXPRESSVPN CIDR block (172.98.32.0/23). Current risk assessment indicates LOW RISK (risk score: 25) with no active threat indicators. The IP presents as a firewalled endpoint with no open services detected. Network neighborhood analysis shows moderate abuse density (14.95%) within the /24 subnet, but the subject IP itself maintains clean operational status.
---
## OWNERSHIP & INFRASTRUCTURE
| Attribute | Value |
|---|---|
| **ASN** | 396356 |
| **Organization** | Prefixx, Inc. |
| **Netname** | PFX-EXPRESSVPN |
| **CIDR Block** | 172.98.32.0/23 |
| **Location** | Dallas, Texas, US |
| **Geolocation Confidence** | Low (geoPlausible: false) |
Network Classification: Firewalled / No Services
IPv6 Support: None detected
Cloud/Hosting/CDN: Not identified
---
## THREAT INDICATORS
| Indicator | Status | Details |
|---|---|---|
| **Blacklist Count** | 0 | No blacklist entries |
| **Known Attacker** | False | No attacker signatures |
| **Tor Exit Node** | False | Not a Tor exit |
| **Spam Source** | False | No spam indicators |
| **DNSBL Listings** | 1 of 8 | Minimal operator score (0.1304) |
| **Threat Feeds** | None | No threat feed matches |
Abuse Confidence Score: Not applicable (no active threats)
---
## NETWORK BEHAVIOR
Service Status: No open ports detected
DNS Resolution: Forward resolution failed; no PTR records
HTTP/HTTPS: No TLS certificate; no HTTP banner
SSL/TLS: No certificate data available
Email Auth: No SPF or DMARC records configured
Control Plane Stability:
- Route changes (30d): 0
- Route stability: False
- DNSSEC: Valid
- IRR Consistency: Not evaluated
---
## NEIGHBORHOOD ANALYSIS (172.98.33.0/24)
| Metric | Value |
|---|---|
| **Total Siblings** | 107 |
| **Active Siblings** | 68 |
| **Threat Siblings** | 16 |
| **Abuse Density** | 14.95% |
| **Subnet Classification** | Mostly Clean |
| **Inherited Risk** | 5 |
Risk Distribution in /24:
- High Risk: 0
- Medium Risk: 1
- Low Risk: 99
Notable Neighbors: 172.98.33.5, 172.98.33.6, 172.98.33.8, 172.98.33.9, 172.98.33.11 (all risk score: 20, authority: 50)
---
## OBSERVATION HISTORY (Last 17 Signals)
Temporal Analysis: Observations from 2026-07-29
- Geo Validation: RTT 60.0ms < minimum possible 160.0ms for claimed 7,998km distance – location implausible
- Scan Activity: Multiple port scans detected (signal confidence: 0.70)
- Ownership: Stable (0 changes recorded)
- Threat Persistence: None (threat_observation_count: 0)
Signal Types Observed: Port scans, geolocation probes, subnet analysis, ownership verification
---
## RELATIONSHIP GRAPH
Primary Association: PFX-EXPRESSVPN network (4 relationship entries)
Linked Entities: None (network-only relationships identified)
---
## SECURITY ACTIONS & RECOMMENDATIONS
Current Risk Score: 25 (Low Risk)
Recommended Action: Monitor; no immediate blocking required
Firewall Rules: None generated (risk below threshold)
WAF Rules: None applicable
Additional Monitoring: Continue passive observation; neighborhood abuse density warrants periodic review
---
## ANALYST NOTES
1. Low Threat Profile: Subject IP maintains clean operational status with no active threat indicators
2. Geolocation Discrepancy: RTT data suggests location claims are implausible – verify actual origin if blocking required
3. Neighborhood Context: 16 threat siblings in /24 subnet indicate potential co-located malicious infrastructure; monitor related IPs if investigation warranted
4. Provider Risk: Authority score of 0 suggests limited provider-level reputation data; maintain monitoring status
5. No Services: Firewalled endpoint with no detectable services reduces exploitation surface
---
End of Briefing
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Prefixx, Inc. |
| ASN | AS396356 |
| Network Name | PFX-EXPRESSVPN |
| CIDR Block | 172.98.32.0/23 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 0% (None) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS396356 |
| Network Prefix | 172.98.33.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 16% | 4 | 4 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Low (35%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-21 00:43:35 UTC |
| Last Seen | 2026-10-06 01:53:49 UTC |
| Profile Built | 2026-10-06 01:56:37 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 21 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 172.98.33.217
Who owns the IP address 172.98.33.217?
172.98.33.217 is registered to Prefixx, Inc.. The address falls within the 172.98.32.0/23 network block. Registration is held at ARIN.
Where is 172.98.33.217 located?
Geolocation data places 172.98.33.217 in Dallas, Texas, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 172.98.33.217 malicious or safe?
172.98.33.217 currently carries a low risk assessment, meaning no significant threat indicators have been observed. This assessment is generated from continuously collected signals and can change over time.