# 172.98.33.223 — IP Intelligence Summary

172.98.33.223 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/172.98.33.223
- Last updated: 2026-10-06

## Ownership

- Organization: Prefixx, Inc.
- Network name: PFX-EXPRESSVPN
- Allocated block: 172.98.32.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: ARIN

## Location

- City: Dallas
- Region: Texas
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IPDEBRIEF INTELLIGENCE BRIEFING

**Target:** 172.98.33.223/32

**Classification:** LOW RISK

**Date:** Current Analysis

**Status:** ACTIVE

\---

\## EXECUTIVE SUMMARY

IP address 172.98.33.223 presents a LOW RISK profile with a risk score of 25/100. The address belongs to Prefixx, Inc. (ASN 396356) operating under the PFX-EXPRESSVPN network block. No active threat indicators detected. The IP exhibits minimal operational activity with services classified as firewalled/no services.

\---

\## OWNERSHIP & GEOLOCATION

| Attribute | Value |

|-----------|-------|

| **Organization** | Prefixx, Inc. |

| **ASN** | 396356 |

| **Network Block** | 172.98.32.0/23 |

| **Country** | United States |

| **Region** | Texas |

| **City** | Dallas |

| **RIR** | ARIN |

| **Abuse Contact** | abuse-reports@vpnconsumer.com |

\---

\## THREAT ASSESSMENT

**Current Risk Score:** 25/100 (Low Risk)

**Threat Indicators:**

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Blacklist Count:** 0

\- **Known Campaigns:** None

\- **Threat Feeds:** None

**Control Plane Analysis:**

\- **Route Stability:** Unstable (isRouteStable: false)

\- **DNSBL Listings:** 1 of 8 total lists

\- **Operator Score:** 0.1304 (Minimal)

\- **DNSSEC Valid:** Yes

**Network Services:**

\- **Open Ports:** None detected

\- **TLS Certificate:** None

\- **HTTP Title:** None

\- **Service Classification:** Firewalled / No Services

\---

\## NEIGHBORHOOD ANALYSIS

**Subnet:** 172.98.33.0/24

**Abuse Density:** 14.95% (0.1495)

**Classification:** Mostly Clean

**Risk Distribution:**

| Risk Level | Count | Percentage |

|------------|-------|------------|

| High | 0 | 0.0% |

| Medium | 1 | 1.0% |

| Low | 99 | 99.0% |

**Sibling Statistics:**

\- Total Siblings: 107

\- Active Siblings: 68

\- Threat Siblings: 16

\---

\## RELATIONSHIP GRAPH

The IP exhibits three recorded relationships, all classified as "Same Network" pointing to PFX-EXPRESSVPN network block. No external entity links detected (hostnames, organizations, certificates).

\---

\## OBSERVATION HISTORY

**Recent Activity:** 14 observations recorded (most recent: 2026-07-29)

**Key Signals:**

\- **Geolocation:** US (confidence: 0.35)

\- **Subnet Abuse Density:** 0.1495 (confidence: 0.75)

\- **Network Classification:** Firewalled/No Services (confidence: 0.30)

\- **Organization:** Prefixx, Inc. (confidence: 0.95)

\- **Registration:** ARIN (confidence: 0.90)

**Temporal Analysis:**

\- Ownership Changes: 0

\- Threat Persistence Days: 0

\- Threat Observation Count: 0

\- Persistently Malicious: No

\---

\## SECURITY ACTIONS & RECOMMENDATIONS

**Current Status:** No immediate action required.

**Recommended Firewall Rules:** None (probabilistic recommendations pending additional signals)

**SOC Analyst Guidance:**

1. **No immediate blocking recommended** - Risk score below threshold for automated action

2. **Monitor for service activation** - Currently firewalled; watch for port opening

3. **Correlate with neighborhood data** - 99% of subnet peers present low risk

4. **Verify against internal allowlists** - Confirm if this IP is expected traffic

\---

\## INTELLIGENCE CONCLUSION

IP 172.98.33.223 represents a residential VPN endpoint with minimal threat profile. The absence of open services, combined with low-risk neighborhood characteristics and lack of threat indicators, suggests this is a legitimate consumer-facing infrastructure endpoint. No immediate defensive action required. Continue standard monitoring practices.

\---

*Analysis generated from IPDebrief intelligence platform data. All data timestamps: 2026-07-29*

## Nearby addresses

- 172.98.33.4 (https://ipdebrief.com/172.98.33.4)
- 172.98.33.5 (https://ipdebrief.com/172.98.33.5)
- 172.98.33.6 (https://ipdebrief.com/172.98.33.6)
- 172.98.33.7 (https://ipdebrief.com/172.98.33.7)
- 172.98.33.8 (https://ipdebrief.com/172.98.33.8)
- 172.98.33.9 (https://ipdebrief.com/172.98.33.9)
- 172.98.33.11 (https://ipdebrief.com/172.98.33.11)
- 172.98.33.12 (https://ipdebrief.com/172.98.33.12)
- 172.98.33.13 (https://ipdebrief.com/172.98.33.13)
- 172.98.33.14 (https://ipdebrief.com/172.98.33.14)
- 172.98.33.15 (https://ipdebrief.com/172.98.33.15)
- 172.98.33.16 (https://ipdebrief.com/172.98.33.16)

---

Source: IPDebrief, "172.98.33.223 IP intelligence", https://ipdebrief.com/172.98.33.223, updated 2026-10-06. Assessments are probabilistic.