216.73.163.30📋 Copy

# IP Intelligence Briefing: 216.73.163.30/32

Classification: LOW RISK

Date: July 2026

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 216.73.163.30 is classified as Low Risk with a risk score of 25. The address belongs to Prefixx, Inc. (ASN 206092) and operates within the PFX-EXPRESSVPN network block (216.73.160.0/22). Current threat indicators indicate no active malicious activity, with the IP showing a clean classification and zero blacklist listings. However, geolocation validation anomalies and minimal service exposure warrant continued monitoring.

---

## Ownership and Network Context

• Organization: Prefixx, Inc.
• Network Name: PFX-EXPRESSVPN
• ASN: 206092
• CIDR Block: 216.73.160.0/22
• Location: San Francisco, California, US
• Registration: ARIN (Registration date not available in dataset)

The IP operates under the PFX-EXPRESSVPN network infrastructure, which is associated with ExpressVPN services. Network classification flags indicate the IP is firewalled with no active services exposed.

---

## Threat Assessment

Current Risk Profile:

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• Threat Feeds: No detections

Malicious Activity Indicators:

• Not a Tor exit node
• Not a known attacker
• Not identified as a spam source
• No known campaign associations
• Zero threat observation count in persistence metrics

Control Plane Data:

• BGP Prefix: 216.73.163.0/24
• Route Stability: False (route changes detected)
• DNSBL Listings: 1 of 8 total lists
• RPKI State: Not validated
• IRR Consistency: Not applicable

---

## Technical Observations

DNS Resolution:

• PTR Hostnames: None
• Forward Resolution Count: 0
• DNSSEC Valid: Yes
• Forward Confirmed: False

Services:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Title: None
• Server Banner: None
• Service Purpose: Firewalled / No Services

Network Traceroute:

• Hop Count: 11
• Transit Networks: Comcast
• First Hop RTT: 0.2ms
• Last Hop RTT: 89.1ms
• Timed Out Hops: 2

---

## Neighborhood Analysis (216.73.163.0/24)

Subnet Statistics:

• Total Siblings: 82
• Active Siblings: 26
• Abuse Density: 0.0244 (Low)
• Threat Siblings: 2

Risk Distribution:

• High Risk: 0
• Medium Risk: 1
• Low Risk: 80

Notable Neighbor:

• 216.73.163.2: Risk Score 60, Authority Score 50 (Elevated)

The subnet exhibits minimal abuse density with a single medium-risk neighbor. The target IP does not inherit significant risk from adjacent addresses.

---

## Historical Trend Analysis

Observation Count: 19 total signals observed

Most Recent Activity: July 28, 2026

Key Historical Indicators:

• Classification: Clean
• Abuse Density: 0.0244 (consistent)
• Inherited Risk: 0
• Ownership Changes: 0 (stable)
• Threat Persistence: 0 days
• Campaign Likelihood: None

Geolocation Anomaly:

Multiple historical probes indicate geolocation validation failures. Claims show San Francisco coordinates (37.2379, -121.7946) with an 8,865.6km distance from probe origin, resulting in RTT violations (83ms observed vs. 177.3ms minimum possible). This suggests either misconfigured geolocation data or proxy usage patterns.

---

## Relationships

Network Associations:

• 4 relationships identified, all categorized as "Same Network"
• Target: PFX-EXPRESSVPN (network-level association)
• No external hostname, organization, or certificate relationships detected

---

## Recommended Actions

For SOC Analysts:

1. Monitor: Continue standard monitoring due to VPN network classification and geolocation anomalies

2. Investigate: Review traffic patterns if connections originate from unexpected geographic locations

3. Block: No immediate blocking required; risk score remains low (25)

4. Alert: Trigger alerts only if risk score increases above 50 or threat indicators emerge

Firewall/IDS Rules:

• No specific blocking rules recommended at this time
• Standard VPN traffic rules applicable

---

## Conclusion

IP 216.73.163.30 presents a low-risk threat profile with no current malicious indicators. The address operates within a VPN service infrastructure (PFX-EXPRESSVPN) and exhibits stable ownership with minimal neighborhood risk. Primary concerns are geolocation validation anomalies and the absence of service exposure, which may indicate proper firewalling but also potential misconfiguration. No immediate action required beyond routine monitoring.

Threat Level: LOW

Action Required: Monitor

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.