# 172.98.33.217 — IP Intelligence Summary

172.98.33.217 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/172.98.33.217
- Last updated: 2026-10-06

## Ownership

- Organization: Prefixx, Inc.
- Network name: PFX-EXPRESSVPN
- Allocated block: 172.98.32.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: ARIN

## Location

- City: Dallas
- Region: Texas
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Subject:** 172.98.33.217/32

**Classification:** Low Risk / Passive

**Generated:** 2026-07-29

**Status:** Complete Analysis

\---

\## EXECUTIVE SUMMARY

IP address 172.98.33.217 belongs to Prefixx, Inc. (ASN 396356) and operates within the PFX-EXPRESSVPN CIDR block (172.98.32.0/23). Current risk assessment indicates LOW RISK (risk score: 25) with no active threat indicators. The IP presents as a firewalled endpoint with no open services detected. Network neighborhood analysis shows moderate abuse density (14.95%) within the /24 subnet, but the subject IP itself maintains clean operational status.

\---

\## OWNERSHIP & INFRASTRUCTURE

| Attribute | Value |

|-----------|-------|

| **ASN** | 396356 |

| **Organization** | Prefixx, Inc. |

| **Netname** | PFX-EXPRESSVPN |

| **CIDR Block** | 172.98.32.0/23 |

| **Location** | Dallas, Texas, US |

| **Geolocation Confidence** | Low (geoPlausible: false) |

**Network Classification:** Firewalled / No Services

**IPv6 Support:** None detected

**Cloud/Hosting/CDN:** Not identified

\---

\## THREAT INDICATORS

| Indicator | Status | Details |

|-----------|--------|---------|

| **Blacklist Count** | 0 | No blacklist entries |

| **Known Attacker** | False | No attacker signatures |

| **Tor Exit Node** | False | Not a Tor exit |

| **Spam Source** | False | No spam indicators |

| **DNSBL Listings** | 1 of 8 | Minimal operator score (0.1304) |

| **Threat Feeds** | None | No threat feed matches |

**Abuse Confidence Score:** Not applicable (no active threats)

\---

\## NETWORK BEHAVIOR

**Service Status:** No open ports detected

**DNS Resolution:** Forward resolution failed; no PTR records

**HTTP/HTTPS:** No TLS certificate; no HTTP banner

**SSL/TLS:** No certificate data available

**Email Auth:** No SPF or DMARC records configured

**Control Plane Stability:**

\- Route changes (30d): 0

\- Route stability: False

\- DNSSEC: Valid

\- IRR Consistency: Not evaluated

\---

\## NEIGHBORHOOD ANALYSIS (172.98.33.0/24)

| Metric | Value |

|--------|-------|

| **Total Siblings** | 107 |

| **Active Siblings** | 68 |

| **Threat Siblings** | 16 |

| **Abuse Density** | 14.95% |

| **Subnet Classification** | Mostly Clean |

| **Inherited Risk** | 5 |

**Risk Distribution in /24:**

\- High Risk: 0

\- Medium Risk: 1

\- Low Risk: 99

**Notable Neighbors:** 172.98.33.5, 172.98.33.6, 172.98.33.8, 172.98.33.9, 172.98.33.11 (all risk score: 20, authority: 50)

\---

\## OBSERVATION HISTORY (Last 17 Signals)

**Temporal Analysis:** Observations from 2026-07-29

\- **Geo Validation:** RTT 60.0ms \< minimum possible 160.0ms for claimed 7,998km distance – location implausible

\- **Scan Activity:** Multiple port scans detected (signal confidence: 0.70)

\- **Ownership:** Stable (0 changes recorded)

\- **Threat Persistence:** None (threat_observation_count: 0)

**Signal Types Observed:** Port scans, geolocation probes, subnet analysis, ownership verification

\---

\## RELATIONSHIP GRAPH

**Primary Association:** PFX-EXPRESSVPN network (4 relationship entries)

**Linked Entities:** None (network-only relationships identified)

\---

\## SECURITY ACTIONS & RECOMMENDATIONS

**Current Risk Score:** 25 (Low Risk)

**Recommended Action:** Monitor; no immediate blocking required

**Firewall Rules:** None generated (risk below threshold)

**WAF Rules:** None applicable

**Additional Monitoring:** Continue passive observation; neighborhood abuse density warrants periodic review

\---

\## ANALYST NOTES

1. **Low Threat Profile:** Subject IP maintains clean operational status with no active threat indicators

2. **Geolocation Discrepancy:** RTT data suggests location claims are implausible – verify actual origin if blocking required

3. **Neighborhood Context:** 16 threat siblings in /24 subnet indicate potential co-located malicious infrastructure; monitor related IPs if investigation warranted

4. **Provider Risk:** Authority score of 0 suggests limited provider-level reputation data; maintain monitoring status

5. **No Services:** Firewalled endpoint with no detectable services reduces exploitation surface

\---

**End of Briefing**

## Nearby addresses

- 172.98.33.4 (https://ipdebrief.com/172.98.33.4)
- 172.98.33.5 (https://ipdebrief.com/172.98.33.5)
- 172.98.33.6 (https://ipdebrief.com/172.98.33.6)
- 172.98.33.7 (https://ipdebrief.com/172.98.33.7)
- 172.98.33.8 (https://ipdebrief.com/172.98.33.8)
- 172.98.33.9 (https://ipdebrief.com/172.98.33.9)
- 172.98.33.11 (https://ipdebrief.com/172.98.33.11)
- 172.98.33.12 (https://ipdebrief.com/172.98.33.12)
- 172.98.33.13 (https://ipdebrief.com/172.98.33.13)
- 172.98.33.14 (https://ipdebrief.com/172.98.33.14)
- 172.98.33.15 (https://ipdebrief.com/172.98.33.15)
- 172.98.33.16 (https://ipdebrief.com/172.98.33.16)

---

Source: IPDebrief, "172.98.33.217 IP intelligence", https://ipdebrief.com/172.98.33.217, updated 2026-10-06. Assessments are probabilistic.