172.98.33.222📋 Copy

# INTELLIGENCE BRIEFING: 172.98.33.222

Date: 2026-07-29

Classification: LOW RISK

Risk Score: 25/100

Assigned Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 172.98.33.222 is assigned to Prefixx, Inc. (ASN 396356) under the PFX-EXPRESSVPN network block. The IP demonstrates low-risk characteristics with no active threat indicators, no open services, and no blacklist associations. Recommended action: Monitor but no immediate blocking required.

---

## OWNERSHIP & NETWORK CLASSIFICATION

Organization: Prefixx, Inc.

Network Name: PFX-EXPRESSVPN

CIDR Block: 172.98.32.0/23

ASN: 396356

RIR: ARIN

Location: Dallas, Texas, US

Network Role: The IP is classified as firewalled with no active services. DNS analysis shows no PTR hostnames, no forward resolution, and zero hosted domains. The absence of open ports indicates the host is not actively exposing services to the public internet.

---

## THREAT ASSESSMENT

Threat Indicators: None detected

Blacklist Associations: 0 lists

Abuse Confidence Score: Not available

Campaign Correlation: No known campaign matches

Known Attacker: No

Tor Exit Node: No

Spam Source: No

Control Plane Analysis:

• DNSBL Listed: 1 of 8 total lists (minimal impact)
• Route Stability: False (BGP prefix changes detected)
• Operator Score: 0.1304 (Minimal)
• RPKI State: Not validated
• IRR Consistency: Not reported

---

## OBSERVATION HISTORY

Total Observations: 16 signals tracked

Recent Activity (2026-07-29):

• 05:44:56 UTC: Subnet classification updated (abuse density: 0.1495, classification: mostly_clean)
• 05:43:53 UTC: Network role confirmed (not CDN, Tor, VPN, proxy, cloud, or hosting)
• 05:46:04 UTC: Geolocation update (US, confidence: 0.35)
• 05:47:31 UTC: Ownership stability confirmed (no changes detected)
• 05:48:13 UTC: RTT measurement recorded (63.6ms avg, 59-68ms range)

Temporal Analysis: Zero threat observation count, zero persistence days, and no ownership changes indicate stable, non-malicious behavior.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 172.98.33.0/24

Total Siblings: 107 IPs

Active Siblings: 68 IPs

Threat Siblings: 16 IPs

Abuse Density: 0.1495 (14.95%)

Inherited Risk: 5/100

Classification: mostly_clean

Risk Distribution: High: 0, Medium: 1, Low: 99

The subnet demonstrates low-to-moderate abuse density with the majority of sibling IPs classified as low-risk. The target IP's inherited risk score of 5 is minimal, confirming it operates within a generally clean network environment.

---

## RELATIONSHIP GRAPH

Related Entities: 3 relationships identified

• All relationships map to "PFX-EXPRESSVPN" network classification
• No external organization, hostname, or certificate associations detected

---

## TRAFFIC BEHAVIOR

Traceroute Analysis:

• Hop Count: 12
• First Hop RTT: 0.4ms
• Last Hop RTT: 55.5ms
• Timed Out Hops: 2
• Transit Networks: Comcast, GTT

Behavioral Indicators:

• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0

---

## RECOMMENDED ACTIONS

Risk Score: 25 (Low Risk)

Action: Monitor

No immediate blocking or firewall rules recommended. The IP presents a low-risk profile with no active threat indicators. Continued passive monitoring is appropriate.

---

## ANALYST NOTES

This IP belongs to a VPN provider infrastructure (PFX-EXPRESSVPN). The combination of no open services, zero threat indicators, and low inherited risk from the subnet suggests legitimate operational use. The absence of blacklist associations and the "mostly_clean" subnet classification support this assessment.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.