216.73.161.101📋 Copy

## INTELLIGENCE BRIEFING: 216.73.161.101

CLASSIFICATION: Low Risk / No Active Threat Indicators

DATE: Current as of latest observation cycle

---

EXECUTIVE SUMMARY

IP address 216.73.161.101 operates within the PFX-EXPRESSVPN infrastructure block (216.73.160.0/22) and presents minimal threat indicators. The address shows no active malicious behavior, threat associations, or blacklist listings. Network scanning indicates the host is firewalled with no services currently exposed.

---

OWNERSHIP AND INFRASTRUCTURE

Organization: Prefixx, Inc.

Netname: PFX-EXPRESSVPN

ASN: 206092

CIDR Block: 216.73.160.0/22

RIR: ARIN

Abuse Contact: Available via RDAP

The IP belongs to a VPN provider infrastructure block with multiple subnets under the same organizational control.

---

RISK ASSESSMENT

Threat Indicators:

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Known Campaigns: None

---

NETWORK CHARACTERISTICS

Geolocation: United States (New York region)

Note: Geolocation validation flagged as implausible (claimed distance 5,968km from probe location with 20ms RTT vs. minimum possible 119.4ms for that distance)

DNS Status:

• PTR Resolution: None
• Forward Resolution: Inactive
• Hosted Domains: 0
• Email Authentication (SPF/DMARC): Not configured

Services: Firewalled / No Services Open

Open Ports: None detected

TLS Certificate: None

---

NETWORK NEIGHBORHOOD ANALYSIS

Subnet: 216.73.161.0/24

Classification: Clean

Abuse Density: 0 (0% of neighbors flagged as threats)

Risk Distribution:

• High Risk: 0/53 neighbors
• Medium Risk: 2/53 neighbors
• Low Risk: 51/53 neighbors

Notable Neighbors:

• 216.73.161.80: Risk Score 25, Authority Score 50
• 216.73.161.94: Risk Score 25, Authority Score 50
• 216.73.161.98: Risk Score 20, Authority Score 50
• 216.73.161.105: Risk Score 20, Authority Score 50
• 216.73.161.106: Risk Score 20, Authority Score 50

The subnet demonstrates low overall abuse density with the target IP showing no inherited risk from neighboring addresses.

---

OBSERVATION HISTORY

Total Observations: 17

Recent Activity: All observations from 2026-07-29 indicate:

• Network scanning completed with no services detected
• Geolocation signals from multiple sources (US classification)
• Network role classification as firewalled infrastructure
• Subnet-level analysis confirming clean classification

No temporal patterns suggest escalating threat activity.

---

RELATIONSHIP GRAPH

Direct Relationships: 4 (all Same Network)

• All relationships map to PFX-EXPRESSVPN network identifiers

No external network associations, hostnames, organizations, or certificates detected outside the infrastructure block.

---

CONTROL PLANE DATA

Origin ASN: 206092

BGP Prefix: 216.73.160.0/23

Route Stability: Not stable

RPKI State: Unknown

IRR Consistency: Unknown

DNSSEC Valid: Yes

DNSBL Listed: 0/8 total lists

---

TRACERoute ANALYSIS

Hop Count: 11

First Hop RTT: 0.3ms

Last Hop RTT: 22.6ms

Timed Out Hops: 2

Transit Networks: Comcast

---

RECOMMENDED ACTIONS

Firewall/Routing: No restrictive rules required. The IP presents no active threat indicators.

Monitoring: Standard monitoring practices apply. No special attention warranted.

Threat Intelligence: No alerts or threat feeds indicate malicious activity from this address.

---

CONCLUSION

IP 216.73.161.101 represents a low-risk infrastructure endpoint within a VPN provider network block. The address shows no evidence of malicious activity, threat associations, or abuse patterns. The subnet maintains a clean classification with minimal abuse density. No immediate defensive actions are required, though standard network monitoring practices should continue.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.