216.73.163.180📋 Copy

## INTELLIGENCE BRIEFING: IP Address 216.73.163.180/32

Date: 2026-07-28

Classification: Low Risk

Risk Score: 25/100

Executive Summary

IP address 216.73.163.180 belongs to Prefixx, Inc. (ASN 206092) and is allocated under the PFX-EXPRESSVPN network block (216.73.160.0/22). The IP presents a low-risk profile (score 25) with no active threat indicators, no known associations with malicious campaigns, and no services currently accessible. Geolocation data shows validation concerns regarding RTT anomalies.

Ownership and Network Classification

• Organization: Prefixx, Inc.
• Network Name: PFX-EXPRESSVPN
• CIDR Block: 216.73.160.0/22
• ASN: 206092
• RIR: ARIN
• Network Type: Provider/Express VPN infrastructure
• Service Status: Firewalled / No Services Open

Geolocation Assessment

• Reported Location: California, US (San Francisco coordinates: 37.2379, -121.7946)
• Geolocation Confidence: Low (35%)
• Validation Status: Failed - RTT anomaly detected
• Observed RTT: 83ms
• Expected Minimum RTT: 177.3ms (based on claimed distance of 8,865.6km)
• Assessment: The geolocation data shows implausible characteristics, with observed RTT significantly below the theoretical minimum for the claimed distance. This suggests the reported location may be inaccurate or the IP is geographically displaced.

Threat Intelligence Profile

• Abuse Confidence Score: Not reported
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Known Attacker: No
• Known Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None identified
• Threat Feeds: No matches

Network Behavior Analysis

• Open Ports: None detected
• TLS Certificate: Not present
• HTTP Title: Not available (firewalled)
• Server Banner: None
• Connection Type: No active services observed

Neighborhood Analysis (216.73.163.0/24)

• Total Subnet Size: 82 sibling IPs
• Active Siblings: 26
• Threat Siblings: 2
• Risk Distribution: 0 High, 1 Medium, 80 Low
• Abuse Density: 0.0244 (2.44%)
• Subnet Classification: Clean
• Neighboring High-Risk IPs: 216.73.163.2 (risk score: 60), 216.73.163.10 (risk score: 20)

Historical Observation Summary

• Total Observations: 17 signals
• Observation Period: Recent activity concentrated within 2026-07-28
• Threat Persistence: 0 days
• Ownership Changes: 0
• Signal Types Observed: Geolocation, port scanning, network classification, subnet analysis
• Threat Trend: No evidence of escalating malicious behavior

Relationship Graph

• Total Relationships: 4
• Relationship Type: Same Network (PFX-EXPRESSVPN)
• Associated Entities: PFX-EXPRESSVPN network (repeated across all relationships)

Recommended Security Actions

Risk Level: LOW

• No immediate firewall rules recommended
• No active threat indicators requiring blocking
• Monitor for service activation or risk score escalation

Operational Notes for SOC Analysts

1. False Positive Potential: The IP is associated with a VPN provider (PFX-EXPRESSVPN) and may legitimately handle encrypted traffic. Low-risk profile suggests minimal immediate concern.

2. Geolocation Discrepancy: The reported San Francisco location conflicts with network performance data. This may indicate routing anomalies or inaccurate RIR registration data.

3. Subnet Context: The broader /24 subnet shows minimal abuse density (2.44%) with only 2 threat siblings. This IP operates in a relatively clean neighborhood.

4. DNSBL Presence: Single DNSBL listing warrants periodic review but does not indicate active abuse based on current profile.

5. No Active Services: The firewall/no-services status reduces attack surface and suggests limited direct exploitation risk.

Conclusion

IP 216.73.163.180 represents a low-risk address associated with VPN infrastructure. While geolocation data shows validation issues, the IP itself demonstrates no malicious behavior indicators. The subnet maintains a clean classification with minimal abuse density. No immediate blocking or investigative actions required beyond routine monitoring for service activation or risk score changes.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.