# 172.98.33.81 — IP Intelligence Summary

172.98.33.81 is an IPv4 address operated by Prefixx, Inc. (AS396356), geolocated to Dallas, United States. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/172.98.33.81
- Last updated: 2026-10-06

## Ownership

- Organization: Prefixx, Inc.
- Network name: PFX-EXPRESSVPN
- Allocated block: 172.98.32.0/23
- ASN: AS396356 (https://ipdebrief.com/asn/396356)
- Regional registry: ARIN

## Location

- City: Dallas
- Region: Texas
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 172.98.33.81

**Date:** 2026-07-26

**Classification:** Low Risk

**Assigned Risk Score:** 0

\---

\## Executive Summary

Target IP 172.98.33.81 is a low-risk address belonging to Prefixx, Inc. (PFX-EXPRESSVPN), operating from Dallas, Texas. No direct threat indicators, open services, or malicious activity were detected. The subnet shows minimal abuse density with 14 threat siblings among 107 total addresses.

\---

\## Network Ownership & Classification

| Attribute | Value |

|-----------|-------|

| **ASN** | 396356 |

| **Organization** | Prefixx, Inc. |

| **Netname** | PFX-EXPRESSVPN |

| **CIDR Block** | 172.98.32.0/23 |

| **RIR** | ARIN |

| **Country** | United States (US) |

| **Region/City** | Texas, Dallas |

| **Network Role** | Firewalled / No Services |

The IP is associated with a VPN provider infrastructure. No hosting, CDN, cloud, or residential characteristics were detected.

\---

\## Threat Assessment

**Direct Indicators:**

\- No known attacker flags

\- No Tor exit node activity

\- No spam source designation

\- Zero blacklist entries

\- No associated threat campaigns

\- No certificate matches or banner correlations

**Abuse Metrics:**

\- Abuse Confidence Score: Not applicable (no direct activity)

\- Pulsedive Risk: Not applicable

\- DNSBL Listings: 0 (of 8 total checks)

\---

\## Service & Port Analysis

**Open Ports:** None detected

**TLS Certificate:** Not present

**HTTP Title/Server Banner:** Not detected

**DNS Records:** No PTR hostnames, no forward resolution, no hosted domains

The address shows no active service exposure.

\---

\## Neighborhood Analysis

| Metric | Value |

|--------|-------|

| Subnet | 172.98.33.0/24 |

| Total Siblings | 107 |

| Active Siblings | 31 |

| Threat Siblings | 14 |

| Abuse Density | 0.1308 |

| Classification | Mostly Clean |

| Risk Distribution | High: 0, Medium: 1, Low: 99 |

The subnet exhibits minimal abuse concentration. The target IP (172.98.33.81) maintains a risk score of 0, distinct from neighboring addresses.

\---

\## Observation History

**Total Observations:** 16 signals

**Latest Activity:** 2026-07-26

**Threat Persistence Days:** 0

**Ownership Changes:** 0

Recent signals include geolocation validation, network classification checks, and port scanning attempts. No persistent malicious behavior observed.

\---

\## Control Plane & Routing

\- **Origin ASN:** 396356

\- **BGP Prefix:** 172.98.33.0/24

\- **Route Stability:** Unstable (isRouteStable: false)

\- **Route Changes (30d):** 0

\- **RPKI State:** Not assessed

\- **DNSSEC Valid:** Yes

\- **Hop Count (Traceroute):** 14

\- **Transit Networks:** Comcast, GTT

\---

\## Recommended Actions

**Current Risk Score:** 0

**Recommended Actions:** None required

**Firewall Rules:** None generated

The IP presents no immediate threat requiring defensive measures. Standard monitoring protocols are sufficient.

\---

\## Intelligence Narrative

IP 172.98.33.81 is a clean, low-risk address within the PFX-EXPRESSVPN network infrastructure. The IP shows no direct malicious activity, no open services, and no association with known threat actors or campaigns. The subnet maintains low abuse density (0.1308), with the majority of sibling addresses classified as low risk.

While the network shows 14 threat siblings within the /24 subnet, the target IP itself maintains a risk score of 0 with zero direct threat indicators. No blacklist entries or DNSBL listings were identified. The address is properly firewalled with no detectable services or open ports.

**Recommendation:** Continue standard monitoring. No immediate blocking or mitigation actions required.

## Nearby addresses

- 172.98.33.4 (https://ipdebrief.com/172.98.33.4)
- 172.98.33.5 (https://ipdebrief.com/172.98.33.5)
- 172.98.33.6 (https://ipdebrief.com/172.98.33.6)
- 172.98.33.7 (https://ipdebrief.com/172.98.33.7)
- 172.98.33.8 (https://ipdebrief.com/172.98.33.8)
- 172.98.33.9 (https://ipdebrief.com/172.98.33.9)
- 172.98.33.11 (https://ipdebrief.com/172.98.33.11)
- 172.98.33.12 (https://ipdebrief.com/172.98.33.12)
- 172.98.33.13 (https://ipdebrief.com/172.98.33.13)
- 172.98.33.14 (https://ipdebrief.com/172.98.33.14)
- 172.98.33.15 (https://ipdebrief.com/172.98.33.15)
- 172.98.33.16 (https://ipdebrief.com/172.98.33.16)

---

Source: IPDebrief, "172.98.33.81 IP intelligence", https://ipdebrief.com/172.98.33.81, updated 2026-10-06. Assessments are probabilistic.