# 172.98.33.222 — IP Intelligence Summary 172.98.33.222 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of September 2, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/172.98.33.222 - Last updated: 2026-09-02 ## Ownership - Organization: Prefixx, Inc. - Network name: PFX-EXPRESSVPN - Allocated block: 172.98.32.0/23 - ASN: AS396356 (https://ipdebrief.com/asn/396356) - Regional registry: ARIN ## Location - City: Dallas - Region: Texas - Country: United States - Time zone: — ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (50/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# INTELLIGENCE BRIEFING: 172.98.33.222 **Date:** 2026-07-29 **Classification:** LOW RISK **Risk Score:** 25/100 **Assigned Analyst:** IPDebrief Intelligence Team \--- \## EXECUTIVE SUMMARY IP address 172.98.33.222 is assigned to Prefixx, Inc. (ASN 396356) under the PFX-EXPRESSVPN network block. The IP demonstrates low-risk characteristics with no active threat indicators, no open services, and no blacklist associations. Recommended action: Monitor but no immediate blocking required. \--- \## OWNERSHIP & NETWORK CLASSIFICATION **Organization:** Prefixx, Inc. **Network Name:** PFX-EXPRESSVPN **CIDR Block:** 172.98.32.0/23 **ASN:** 396356 **RIR:** ARIN **Location:** Dallas, Texas, US **Network Role:** The IP is classified as firewalled with no active services. DNS analysis shows no PTR hostnames, no forward resolution, and zero hosted domains. The absence of open ports indicates the host is not actively exposing services to the public internet. \--- \## THREAT ASSESSMENT **Threat Indicators:** None detected **Blacklist Associations:** 0 lists **Abuse Confidence Score:** Not available **Campaign Correlation:** No known campaign matches **Known Attacker:** No **Tor Exit Node:** No **Spam Source:** No **Control Plane Analysis:** \- DNSBL Listed: 1 of 8 total lists (minimal impact) \- Route Stability: False (BGP prefix changes detected) \- Operator Score: 0.1304 (Minimal) \- RPKI State: Not validated \- IRR Consistency: Not reported \--- \## OBSERVATION HISTORY **Total Observations:** 16 signals tracked **Recent Activity (2026-07-29):** \- 05:44:56 UTC: Subnet classification updated (abuse density: 0.1495, classification: mostly_clean) \- 05:43:53 UTC: Network role confirmed (not CDN, Tor, VPN, proxy, cloud, or hosting) \- 05:46:04 UTC: Geolocation update (US, confidence: 0.35) \- 05:47:31 UTC: Ownership stability confirmed (no changes detected) \- 05:48:13 UTC: RTT measurement recorded (63.6ms avg, 59-68ms range) **Temporal Analysis:** Zero threat observation count, zero persistence days, and no ownership changes indicate stable, non-malicious behavior. \--- \## NEIGHBORHOOD ANALYSIS **Subnet:** 172.98.33.0/24 **Total Siblings:** 107 IPs **Active Siblings:** 68 IPs **Threat Siblings:** 16 IPs **Abuse Density:** 0.1495 (14.95%) **Inherited Risk:** 5/100 **Classification:** mostly_clean **Risk Distribution:** High: 0, Medium: 1, Low: 99 The subnet demonstrates low-to-moderate abuse density with the majority of sibling IPs classified as low-risk. The target IP's inherited risk score of 5 is minimal, confirming it operates within a generally clean network environment. \--- \## RELATIONSHIP GRAPH **Related Entities:** 3 relationships identified \- All relationships map to "PFX-EXPRESSVPN" network classification \- No external organization, hostname, or certificate associations detected \--- \## TRAFFIC BEHAVIOR **Traceroute Analysis:** \- Hop Count: 12 \- First Hop RTT: 0.4ms \- Last Hop RTT: 55.5ms \- Timed Out Hops: 2 \- Transit Networks: Comcast, GTT **Behavioral Indicators:** \- Honeypot Hits: 0 \- Enumeration Strikes: 0 \- WAF Violations: 0 \- Total Incidents: 0 \--- \## RECOMMENDED ACTIONS **Risk Score:** 25 (Low Risk) **Action:** Monitor No immediate blocking or firewall rules recommended. The IP presents a low-risk profile with no active threat indicators. Continued passive monitoring is appropriate. \--- \## ANALYST NOTES This IP belongs to a VPN provider infrastructure (PFX-EXPRESSVPN). The combination of no open services, zero threat indicators, and low inherited risk from the subnet suggests legitimate operational use. The absence of blacklist associations and the "mostly_clean" subnet classification support this assessment. ## Nearby addresses - 172.98.33.4 (https://ipdebrief.com/172.98.33.4) - 172.98.33.5 (https://ipdebrief.com/172.98.33.5) - 172.98.33.6 (https://ipdebrief.com/172.98.33.6) - 172.98.33.7 (https://ipdebrief.com/172.98.33.7) - 172.98.33.8 (https://ipdebrief.com/172.98.33.8) - 172.98.33.9 (https://ipdebrief.com/172.98.33.9) - 172.98.33.11 (https://ipdebrief.com/172.98.33.11) - 172.98.33.12 (https://ipdebrief.com/172.98.33.12) - 172.98.33.13 (https://ipdebrief.com/172.98.33.13) - 172.98.33.14 (https://ipdebrief.com/172.98.33.14) - 172.98.33.15 (https://ipdebrief.com/172.98.33.15) - 172.98.33.16 (https://ipdebrief.com/172.98.33.16) --- Source: IPDebrief, "172.98.33.222 IP intelligence", https://ipdebrief.com/172.98.33.222, updated 2026-09-02. Assessments are probabilistic.