# 216.73.161.152 — IP Intelligence Summary

216.73.161.152 is an IPv4 address operated by Prefixx, Inc. (AS206092), geolocated to New York, United States. As of October 7, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/216.73.161.152
- Last updated: 2026-10-07

## Ownership

- Organization: Prefixx, Inc.
- Network name: PFX-EXPRESSVPN
- Allocated block: 216.73.160.0/22
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: ARIN

## Location

- City: New York
- Region: New York
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 216.73.161.152

**Classification:** Low Risk / Passive Infrastructure

**Date:** 2026-07-25

**Analyst:** IPDebrief SOC Team

\---

\## Executive Summary

IP 216.73.161.152 is a low-risk passive infrastructure address associated with Prefixx, Inc. (PFX-EXPRESSVPN). The IP shows no active threat indicators, no known attacker behavior, and no open services. While DNSBL listing exists, overall risk scoring indicates this is not currently malicious.

\---

\## Ownership and Network Context

\- **Organization:** Prefixx, Inc.

\- **Network Name:** PFX-EXPRESSVPN

\- **ASN:** 206092 (SECFIREWALLAS - F.N.S. HOLDINGS LIMITED)

\- **CIDR Block:** 216.73.160.0/22

\- **Geolocation:** New York, US (US-NY)

\- **RIR:** ARIN

\- **Registration:** 2021-10-04

The IP is part of a /24 subnet containing 53 sibling addresses. Neighborhood analysis shows 0 high-risk, 2 medium-risk, and 51 low-risk neighbors with an abuse density score of 0, indicating this subnet is generally well-behaved.

\---

\## Threat Profile

**Risk Score:** 25 (Low Risk)

| Indicator | Status |

|-----------|--------|

| Known Attacker | No |

| Tor Exit Node | No |

| Spam Source | No |

| Known Campaigns | None |

| Open Ports | None (Firewalled) |

| DNSBL Listings | 1 of 8 total lists |

The control plane shows the IP has 1 DNSBL listing out of 8 total lists evaluated. DNSSEC validation is confirmed as valid. Route stability is flagged as unstable (isRouteStable: false).

\---

\## Observations and History

**Total Observations:** 11

Recent observations (2026-07-25) include:

\- DNSSEC validation confirmed (true)

\- ASN resolution to 216.73.160.0/23

\- PTR records absent (null)

\- Forward resolution count: 0

\- Organization confirmed: Prefixx, Inc.

One signal shows blacklist activity with 8 total listings, 1 current listing, and maximum severity rated "high." This suggests historical or passive listing status rather than active abuse.

\---

\## Network Behavior

\- **Connection Type:** Firewalled / No Services

\- **Traceroute:** 12 hops total

\- **Transit Network:** Comcast

\- **First Hop RTT:** 0.2ms

\- **Last Hop RTT:** 21.1ms

\- **Timed Out Hops:** 2

No honeypot hits, enumeration strikes, or WAF violations recorded. No email authentication records (SPF, DMARC) present.

\---

\## Relationship Analysis

Two relationships identified, both classified as "Same Network" pointing to PFX-EXPRESSVPN network entity. No external hostnames, certificates, or correlated IP campaigns detected.

\---

\## Security Recommendations

**Action:** Monitor but do not block. The IP represents legitimate VPN infrastructure.

**Rationale:**

1. Risk score of 25 indicates low threat probability

2. No active attack indicators or known malicious campaigns

3. Neighborhood analysis shows low abuse density

4. Passive firewall status suggests intentional service limitation

**Recommended Action:** Add to monitoring list for continued observation. No immediate firewall blocking required.

\---

**Sources:** IPDebrief Intelligence Platform

**Confidence:** High (DNSSEC validated, multiple geo sources confirmed)

## Nearby addresses

- 216.73.161.70 (https://ipdebrief.com/216.73.161.70)
- 216.73.161.71 (https://ipdebrief.com/216.73.161.71)
- 216.73.161.72 (https://ipdebrief.com/216.73.161.72)
- 216.73.161.73 (https://ipdebrief.com/216.73.161.73)
- 216.73.161.74 (https://ipdebrief.com/216.73.161.74)
- 216.73.161.75 (https://ipdebrief.com/216.73.161.75)
- 216.73.161.77 (https://ipdebrief.com/216.73.161.77)
- 216.73.161.78 (https://ipdebrief.com/216.73.161.78)
- 216.73.161.79 (https://ipdebrief.com/216.73.161.79)
- 216.73.161.80 (https://ipdebrief.com/216.73.161.80)
- 216.73.161.81 (https://ipdebrief.com/216.73.161.81)
- 216.73.161.82 (https://ipdebrief.com/216.73.161.82)

---

Source: IPDebrief, "216.73.161.152 IP intelligence", https://ipdebrief.com/216.73.161.152, updated 2026-10-07. Assessments are probabilistic.