216.73.161.105📋 Copy

IP Intelligence Briefing: 216.73.161.105/32

Subject: Network Threat Assessment

Date: 2026-07-29

Classification: Low Risk / Defensive Monitoring

---

Executive Summary

IP 216.73.161.105 is assigned to Prefixx, Inc. (ASN 206092) under the PFX-EXPRESSVPN organization. The IP demonstrates low-risk characteristics with no active threat indicators, zero blacklist hits, and no detected malicious activity. The address operates within a clean /24 subnet with minimal neighborhood abuse density.

---

Ownership & Infrastructure

• Organization: Prefixx, Inc. (ASN 206092)
• Netname: PFX-EXPRESSVPN
• CIDR Block: 216.73.160.0/22
• Geolocation: United States, New York (ARIN registration)
• Network Role: Firewalled / No Services Detected
• Infrastructure: No CDN, Cloud, VPN, Proxy, or Hosting services active

---

Threat Assessment

• Risk Score: 20/100 (Low Risk)
• Abuse Confidence: Not applicable (clean profile)
• Blacklist Status: 0/8 lists
• Campaign Correlation: No associated campaigns or correlated IPs
• Tor Exit Node: No
• Known Attacker: No

Observed Threat Indicators:

• No malicious indicators detected
• Zero active threat feeds
• No spam source designation
• No known attacker classification

---

Network Behavior & Services

• Open Ports: None detected
• TLS Certificate: Not configured
• HTTP Services: No active HTTP title or banner
• Email Reputation: Not applicable (no domain/hosting)
• Network Classification: Clean

---

Subnet Analysis (216.73.161.0/24)

• Total Siblings: 54 addresses
• Active Siblings: 12
• Abuse Density: 0 (clean)
• Risk Distribution: 0 high-risk, 2 medium-risk, 51 low-risk
• Threat Siblings: 0
• Inherited Risk: 0

---

Observation History

• Total Observations: 17
• Recent Activity: Multiple signals observed 2026-07-29
• Threat Persistence: 0 days (no persistent malicious behavior)
• Ownership Changes: 0
• Key Findings:

- Geolocation signals show low confidence (0.18-0.70)

- RTT anomalies detected: 19ms observed vs 119.4ms minimum possible for claimed 5,968km distance (geo validation violation)

- No honeypot hits or enumeration strikes

---

Relationship Graph

• Same Network Relationships: 4 entries (all PFX-EXPRESSVPN)
• External Links: No organizations, hostnames, or certificates beyond network-level associations
• Network Stability: Route unstable (not isRouteStable)

---

Recommended Actions

1. Monitoring: Continue passive observation; low-risk profile warrants standard monitoring

2. Firewall Rules: No immediate blocking required; consider allowlisting for legitimate traffic

3. Traffic Analysis: Monitor for any changes in network role or service activation

4. Geolocation Review: Investigate RTT anomalies if this IP appears in connection logs—geographic inconsistency detected

---

Conclusion

IP 216.73.161.105 presents a low-risk profile with no active malicious indicators. The subnet demonstrates clean abuse density and minimal threat activity. The primary concern is a geographic validation anomaly (RTT vs claimed location) which may warrant investigation if this address appears in connection logs. No immediate defensive action required; maintain standard monitoring protocols.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.