# 216.73.163.180 — IP Intelligence Summary 216.73.163.180 is an IPv4 address operated by Prefixx, Inc. (AS206092), geolocated to San Francisco, United States. As of September 3, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/216.73.163.180 - Last updated: 2026-09-03 ## Ownership - Organization: Prefixx, Inc. - Network name: PFX-EXPRESSVPN - Allocated block: 216.73.160.0/22 - ASN: AS206092 (https://ipdebrief.com/asn/206092) - Regional registry: ARIN ## Location - City: San Francisco - Region: California - Country: United States - Time zone: — ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \## INTELLIGENCE BRIEFING: IP Address 216.73.163.180/32 **Date:** 2026-07-28 **Classification:** Low Risk **Risk Score:** 25/100 \### Executive Summary IP address 216.73.163.180 belongs to Prefixx, Inc. (ASN 206092) and is allocated under the PFX-EXPRESSVPN network block (216.73.160.0/22). The IP presents a low-risk profile (score 25) with no active threat indicators, no known associations with malicious campaigns, and no services currently accessible. Geolocation data shows validation concerns regarding RTT anomalies. \### Ownership and Network Classification \- **Organization:** Prefixx, Inc. \- **Network Name:** PFX-EXPRESSVPN \- **CIDR Block:** 216.73.160.0/22 \- **ASN:** 206092 \- **RIR:** ARIN \- **Network Type:** Provider/Express VPN infrastructure \- **Service Status:** Firewalled / No Services Open \### Geolocation Assessment \- **Reported Location:** California, US (San Francisco coordinates: 37.2379, -121.7946) \- **Geolocation Confidence:** Low (35%) \- **Validation Status:** Failed - RTT anomaly detected \- **Observed RTT:** 83ms \- **Expected Minimum RTT:** 177.3ms (based on claimed distance of 8,865.6km) \- **Assessment:** The geolocation data shows implausible characteristics, with observed RTT significantly below the theoretical minimum for the claimed distance. This suggests the reported location may be inaccurate or the IP is geographically displaced. \### Threat Intelligence Profile \- **Abuse Confidence Score:** Not reported \- **Blacklist Status:** Listed on 1 of 8 DNSBLs \- **Known Attacker:** No \- **Known Spam Source:** No \- **Tor Exit Node:** No \- **Known Campaigns:** None identified \- **Threat Feeds:** No matches \### Network Behavior Analysis \- **Open Ports:** None detected \- **TLS Certificate:** Not present \- **HTTP Title:** Not available (firewalled) \- **Server Banner:** None \- **Connection Type:** No active services observed \### Neighborhood Analysis (216.73.163.0/24) \- **Total Subnet Size:** 82 sibling IPs \- **Active Siblings:** 26 \- **Threat Siblings:** 2 \- **Risk Distribution:** 0 High, 1 Medium, 80 Low \- **Abuse Density:** 0.0244 (2.44%) \- **Subnet Classification:** Clean \- **Neighboring High-Risk IPs:** 216.73.163.2 (risk score: 60), 216.73.163.10 (risk score: 20) \### Historical Observation Summary \- **Total Observations:** 17 signals \- **Observation Period:** Recent activity concentrated within 2026-07-28 \- **Threat Persistence:** 0 days \- **Ownership Changes:** 0 \- **Signal Types Observed:** Geolocation, port scanning, network classification, subnet analysis \- **Threat Trend:** No evidence of escalating malicious behavior \### Relationship Graph \- **Total Relationships:** 4 \- **Relationship Type:** Same Network (PFX-EXPRESSVPN) \- **Associated Entities:** PFX-EXPRESSVPN network (repeated across all relationships) \### Recommended Security Actions **Risk Level:** LOW \- No immediate firewall rules recommended \- No active threat indicators requiring blocking \- Monitor for service activation or risk score escalation \### Operational Notes for SOC Analysts 1. **False Positive Potential:** The IP is associated with a VPN provider (PFX-EXPRESSVPN) and may legitimately handle encrypted traffic. Low-risk profile suggests minimal immediate concern. 2. **Geolocation Discrepancy:** The reported San Francisco location conflicts with network performance data. This may indicate routing anomalies or inaccurate RIR registration data. 3. **Subnet Context:** The broader /24 subnet shows minimal abuse density (2.44%) with only 2 threat siblings. This IP operates in a relatively clean neighborhood. 4. **DNSBL Presence:** Single DNSBL listing warrants periodic review but does not indicate active abuse based on current profile. 5. **No Active Services:** The firewall/no-services status reduces attack surface and suggests limited direct exploitation risk. \### Conclusion IP 216.73.163.180 represents a low-risk address associated with VPN infrastructure. While geolocation data shows validation issues, the IP itself demonstrates no malicious behavior indicators. The subnet maintains a clean classification with minimal abuse density. No immediate blocking or investigative actions required beyond routine monitoring for service activation or risk score changes. ## Nearby addresses - 216.73.163.2 (https://ipdebrief.com/216.73.163.2) - 216.73.163.4 (https://ipdebrief.com/216.73.163.4) - 216.73.163.6 (https://ipdebrief.com/216.73.163.6) - 216.73.163.7 (https://ipdebrief.com/216.73.163.7) - 216.73.163.10 (https://ipdebrief.com/216.73.163.10) - 216.73.163.11 (https://ipdebrief.com/216.73.163.11) - 216.73.163.12 (https://ipdebrief.com/216.73.163.12) - 216.73.163.13 (https://ipdebrief.com/216.73.163.13) - 216.73.163.16 (https://ipdebrief.com/216.73.163.16) - 216.73.163.20 (https://ipdebrief.com/216.73.163.20) - 216.73.163.22 (https://ipdebrief.com/216.73.163.22) - 216.73.163.24 (https://ipdebrief.com/216.73.163.24) --- Source: IPDebrief, "216.73.163.180 IP intelligence", https://ipdebrief.com/216.73.163.180, updated 2026-09-03. Assessments are probabilistic.