172.98.33.224📋 Copy

# INTELLIGENCE BRIEFING: 172.98.33.224/32

Classification: Low Risk | Date: 2026-07-29 | Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 172.98.33.224 belongs to Prefixx, Inc. (ASN 396356) and operates within the PFX-EXPRESSVPN network block (172.98.32.0/23). The IP is classified as Low Risk with an overall risk score of 25. No active threat indicators were observed, and the IP shows characteristics consistent with VPN infrastructure.

## Ownership and Network Context

• Organization: Prefixx, Inc.
• Netname: PFX-EXPRESSVPN
• ASN: 396356
• CIDR Block: 172.98.32.0/23
• RIR: ARIN
• Abuse Contact: abuse-reports@vpnconsumer.com
• Registration Date: Not available in current records

## Geolocation Analysis

Multiple geolocation sources indicate the IP is located within the United States. Recent observations show conflicting data:

• Primary Profile: Boston, Massachusetts (US-MA)
• History Observation: Dallas, Texas (US-TX)
• Geographic Consensus: Mixed sources (2 geo sources with consensus flag)

The geolocation inconsistency is consistent with VPN provider infrastructure that may utilize multiple endpoint locations.

## Threat Intelligence Indicators

• Risk Score: 25 (Low Risk)
• Blacklist Count: 0
• DNSBL Listed: 1 of 8 total lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None recorded
• Known Campaigns: None associated

The IP demonstrates no malicious activity patterns and is not associated with any known threat actors or campaigns.

## Network Services and Behavioral Analysis

• Open Ports: None detected
• TLS Certificate: Not present
• HTTP Title: Not present
• Service Purpose: Firewalled / No Services
• Honeypot Hits: 0
• Enumeration Strikes: 0
• WAF Violations: 0
• Total Incidents: 0

The absence of open ports and services is consistent with VPN endpoint behavior or properly secured infrastructure.

## Neighborhood Analysis (172.98.33.0/24)

• Total Neighbors: 100 IPs in /24 subnet
• Abuse Density: 0.0
• Risk Distribution: 99 Low Risk, 1 Medium Risk, 0 High Risk
• Inherited Risk: 5

The subnet exhibits minimal abuse characteristics. Neighboring IPs demonstrate risk scores in the 20 range with authority scores of 50, indicating controlled, legitimate infrastructure.

## Control Plane Assessment

• Origin ASN: 396356
• BGP Prefix: 172.98.33.0/24
• Route Stability: False
• RPKI State: Not validated
• IRRI Consistency: Not available
• Route Changes (30d): 0
• Operator Score: 0.1304 (Minimal)
• DNSSEC Valid: True

## Historical Signal Observations

Thirteen signal observations recorded for this IP. Recent activity shows:

• Classification: mostly_clean
• Inherited Risk: 5
• Subnet Abuse Density: 0.1495
• Total Siblings: 107
• Active Siblings: 68
• Threat Siblings: 16

No escalation in threat posture observed over the observation period.

## Relationship Graph

Two relationships identified, both classified as "Same Network" targeting PFX-EXPRESSVPN. No cross-referenced hostnames, organizations, or certificates detected beyond the network-level association.

## Recommended Security Actions

No specific blocking or rate-limiting rules recommended at this time. The IP is classified as Low Risk with no active threat indicators. Standard monitoring is advised.

---

Assessment: IP 172.98.33.224 represents legitimate VPN infrastructure from Prefixx, Inc. with no observable malicious activity. The low risk score, absence of open services, and minimal neighborhood abuse density support continued monitoring without restrictive controls.

Priority: Routine | Action Required: None

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.