172.98.33.219📋 Copy

# IP INTELLIGENCE BRIEFING

## Target: 172.98.33.219/32

Date: 2026-07-29

Classification: Defensive Intelligence

Risk Level: LOW

---

EXECUTIVE SUMMARY

IP 172.98.33.219 is a low-risk address assigned to Prefixx, Inc. (ASN 396356) within the PFX-EXPRESSVPN block. The IP shows no active threat indicators, is not blacklisted, and operates without open services. Geolocation validation anomalies detected.

---

OWNERSHIP & INFRASTRUCTURE

• Organization: Prefixx, Inc.
• ASN: 396356
• Network: PFX-EXPRESSVPN (172.98.32.0/23)
• RIR: ARIN
• Geolocation Claimed: Dallas, Texas, US
• Network Role: Infrastructure/VPN

---

RISK PROFILE

Threat Indicators: No malicious activity detected. No threat feed matches, no known attacker indicators, no spam source classification.

---

SERVICE & NETWORK ACTIVITY

• Open Ports: None detected
• DNS Records: No PTR hostnames, no forward resolution
• TLS/HTTP: No services exposed
• Network Classification: Not CDN, not cloud, not hosting, not mobile

---

GEOLOCATION VALIDATION

CRITICAL ANOMALY DETECTED:

• Claimed Location: Dallas, TX, US
• Measured Distance: 7,998.3 km (inconsistent with claimed location)
• RTT Violation: 59.0ms measured vs. 160.0ms minimum possible for claimed distance
• Probe Count: 5 probes
• Conclusion: IP claims Dallas location but network measurements indicate actual location is significantly distant from claimed coordinates.

---

CONTROL PLANE STATUS

• BGP Prefix: 172.98.33.0/24
• Route Stability: Not stable (0 changes in 30 days)
• Route Changes (30d): 0
• DNSSEC: Valid
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not validated

---

NEIGHBORHOOD ANALYSIS

Subnet: 172.98.33.0/24

• Total Siblings: 107 IPs
• Active Siblings: 68
• Threat Siblings: 16
• Abuse Density: 0.1495 (Low-Moderate)
• Classification: Mostly Clean
• Inherited Risk: 5
• Risk Distribution: 0 High, 1 Medium, 99 Low

Notable Neighbors: Multiple IPs in /24 share risk score of 20 with authority score of 50.

---

OBSERVATION HISTORY

Total Observations: 16 signals collected

• Recent Activity: Minimal threat persistence
• Ownership Changes: None detected
• Threat Observation Count: 0
• Is Persistently Malicious: False

Latest Signals:

• Geolocation probes showing RTT violations
• Neighborhood abuse density monitoring
• Network role classification

---

RELATIONSHIP GRAPH

• Same Network References: PFX-EXPRESSVPN (4 relationship entries)
• No External Relationships: No associated hostnames, certificates, or organizations beyond network block

---

RECOMMENDED ACTIONS

Status: No immediate action required

Monitoring Recommendations:

1. Continue monitoring geolocation consistency (RTT anomalies present)

2. Watch for service exposure as this IP currently shows no open ports

3. Monitor subnet-level abuse density (currently low)

Firewall/Security:

• No blocking recommended based on current risk profile
• Standard egress filtering applies

---

INTELLIGENCE CONCLUSIONS

IP 172.98.33.219 presents as a benign infrastructure endpoint with no active malicious indicators. The primary intelligence concern is geolocation reporting inconsistency, which may indicate:

• Misconfigured geolocation reporting
• Use of proxy/relay infrastructure
• VPN endpoint characteristics

Threat Level: LOW

Action Required: None

Monitoring Priority: Standard

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.