# 172.98.33.219 — IP Intelligence Summary

172.98.33.219 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of September 5, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/172.98.33.219
- Last updated: 2026-09-05

## Ownership

- Organization: Prefixx, Inc.
- Network name: PFX-EXPRESSVPN
- Allocated block: 172.98.32.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: ARIN

## Location

- City: Dallas
- Region: Texas
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (50/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

\## Target: 172.98.33.219/32

**Date:** 2026-07-29

**Classification:** Defensive Intelligence

**Risk Level:** LOW

\---

\### EXECUTIVE SUMMARY

IP 172.98.33.219 is a low-risk address assigned to Prefixx, Inc. (ASN 396356) within the PFX-EXPRESSVPN block. The IP shows no active threat indicators, is not blacklisted, and operates without open services. Geolocation validation anomalies detected.

\---

\### OWNERSHIP & INFRASTRUCTURE

\- **Organization:** Prefixx, Inc.

\- **ASN:** 396356

\- **Network:** PFX-EXPRESSVPN (172.98.32.0/23)

\- **RIR:** ARIN

\- **Geolocation Claimed:** Dallas, Texas, US

\- **Network Role:** Infrastructure/VPN

\---

\### RISK PROFILE

| Metric | Value |

|--------|-------|

| Overall Risk Score | 20 (Low) |

| Abuse Confidence | None |

| Blacklist Count | 0 |

| Known Campaigns | None |

| Reputation | Low Risk |

**Threat Indicators:** No malicious activity detected. No threat feed matches, no known attacker indicators, no spam source classification.

\---

\### SERVICE & NETWORK ACTIVITY

\- **Open Ports:** None detected

\- **DNS Records:** No PTR hostnames, no forward resolution

\- **TLS/HTTP:** No services exposed

\- **Network Classification:** Not CDN, not cloud, not hosting, not mobile

\---

\### GEOLOCATION VALIDATION

**CRITICAL ANOMALY DETECTED:**

\- **Claimed Location:** Dallas, TX, US

\- **Measured Distance:** 7,998.3 km (inconsistent with claimed location)

\- **RTT Violation:** 59.0ms measured vs. 160.0ms minimum possible for claimed distance

\- **Probe Count:** 5 probes

\- **Conclusion:** IP claims Dallas location but network measurements indicate actual location is significantly distant from claimed coordinates.

\---

\### CONTROL PLANE STATUS

\- **BGP Prefix:** 172.98.33.0/24

\- **Route Stability:** Not stable (0 changes in 30 days)

\- **Route Changes (30d):** 0

\- **DNSSEC:** Valid

\- **Operator Score:** 0.1304 (Minimal)

\- **RPKI State:** Not validated

\---

\### NEIGHBORHOOD ANALYSIS

**Subnet:** 172.98.33.0/24

\- **Total Siblings:** 107 IPs

\- **Active Siblings:** 68

\- **Threat Siblings:** 16

\- **Abuse Density:** 0.1495 (Low-Moderate)

\- **Classification:** Mostly Clean

\- **Inherited Risk:** 5

\- **Risk Distribution:** 0 High, 1 Medium, 99 Low

**Notable Neighbors:** Multiple IPs in /24 share risk score of 20 with authority score of 50.

\---

\### OBSERVATION HISTORY

**Total Observations:** 16 signals collected

\- **Recent Activity:** Minimal threat persistence

\- **Ownership Changes:** None detected

\- **Threat Observation Count:** 0

\- **Is Persistently Malicious:** False

**Latest Signals:**

\- Geolocation probes showing RTT violations

\- Neighborhood abuse density monitoring

\- Network role classification

\---

\### RELATIONSHIP GRAPH

\- **Same Network References:** PFX-EXPRESSVPN (4 relationship entries)

\- **No External Relationships:** No associated hostnames, certificates, or organizations beyond network block

\---

\### RECOMMENDED ACTIONS

**Status:** No immediate action required

**Monitoring Recommendations:**

1. Continue monitoring geolocation consistency (RTT anomalies present)

2. Watch for service exposure as this IP currently shows no open ports

3. Monitor subnet-level abuse density (currently low)

**Firewall/Security:**

\- No blocking recommended based on current risk profile

\- Standard egress filtering applies

\---

\### INTELLIGENCE CONCLUSIONS

IP 172.98.33.219 presents as a benign infrastructure endpoint with no active malicious indicators. The primary intelligence concern is geolocation reporting inconsistency, which may indicate:

\- Misconfigured geolocation reporting

\- Use of proxy/relay infrastructure

\- VPN endpoint characteristics

**Threat Level:** LOW

**Action Required:** None

**Monitoring Priority:** Standard

## Nearby addresses

- 172.98.33.4 (https://ipdebrief.com/172.98.33.4)
- 172.98.33.5 (https://ipdebrief.com/172.98.33.5)
- 172.98.33.6 (https://ipdebrief.com/172.98.33.6)
- 172.98.33.7 (https://ipdebrief.com/172.98.33.7)
- 172.98.33.8 (https://ipdebrief.com/172.98.33.8)
- 172.98.33.9 (https://ipdebrief.com/172.98.33.9)
- 172.98.33.11 (https://ipdebrief.com/172.98.33.11)
- 172.98.33.12 (https://ipdebrief.com/172.98.33.12)
- 172.98.33.13 (https://ipdebrief.com/172.98.33.13)
- 172.98.33.14 (https://ipdebrief.com/172.98.33.14)
- 172.98.33.15 (https://ipdebrief.com/172.98.33.15)
- 172.98.33.16 (https://ipdebrief.com/172.98.33.16)

---

Source: IPDebrief, "172.98.33.219 IP intelligence", https://ipdebrief.com/172.98.33.219, updated 2026-09-05. Assessments are probabilistic.