# 216.73.163.30 — IP Intelligence Summary 216.73.163.30 is an IPv4 address operated by Prefixx, Inc. (AS206092), geolocated to San Francisco, United States. As of September 5, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/216.73.163.30 - Last updated: 2026-09-05 ## Ownership - Organization: Prefixx, Inc. - Network name: PFX-EXPRESSVPN - Allocated block: 216.73.160.0/22 - ASN: AS206092 (https://ipdebrief.com/asn/206092) - Regional registry: ARIN ## Location - City: San Francisco - Region: California - Country: United States - Time zone: — ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 216.73.163.30/32 **Classification:** LOW RISK **Date:** July 2026 **Analyst:** IPDebrief Intelligence Team \--- \## Executive Summary IP 216.73.163.30 is classified as **Low Risk** with a risk score of 25. The address belongs to Prefixx, Inc. (ASN 206092) and operates within the PFX-EXPRESSVPN network block (216.73.160.0/22). Current threat indicators indicate no active malicious activity, with the IP showing a clean classification and zero blacklist listings. However, geolocation validation anomalies and minimal service exposure warrant continued monitoring. \--- \## Ownership and Network Context \- **Organization:** Prefixx, Inc. \- **Network Name:** PFX-EXPRESSVPN \- **ASN:** 206092 \- **CIDR Block:** 216.73.160.0/22 \- **Location:** San Francisco, California, US \- **Registration:** ARIN (Registration date not available in dataset) The IP operates under the PFX-EXPRESSVPN network infrastructure, which is associated with ExpressVPN services. Network classification flags indicate the IP is firewalled with no active services exposed. \--- \## Threat Assessment **Current Risk Profile:** \- **Risk Score:** 25 (Low Risk) \- **Abuse Confidence Score:** Not applicable \- **Blacklist Count:** 0 \- **Threat Feeds:** No detections **Malicious Activity Indicators:** \- Not a Tor exit node \- Not a known attacker \- Not identified as a spam source \- No known campaign associations \- Zero threat observation count in persistence metrics **Control Plane Data:** \- BGP Prefix: 216.73.163.0/24 \- Route Stability: False (route changes detected) \- DNSBL Listings: 1 of 8 total lists \- RPKI State: Not validated \- IRR Consistency: Not applicable \--- \## Technical Observations **DNS Resolution:** \- PTR Hostnames: None \- Forward Resolution Count: 0 \- DNSSEC Valid: Yes \- Forward Confirmed: False **Services:** \- Open Ports: None detected \- TLS Certificate: None \- HTTP Title: None \- Server Banner: None \- Service Purpose: Firewalled / No Services **Network Traceroute:** \- Hop Count: 11 \- Transit Networks: Comcast \- First Hop RTT: 0.2ms \- Last Hop RTT: 89.1ms \- Timed Out Hops: 2 \--- \## Neighborhood Analysis (216.73.163.0/24) **Subnet Statistics:** \- **Total Siblings:** 82 \- **Active Siblings:** 26 \- **Abuse Density:** 0.0244 (Low) \- **Threat Siblings:** 2 **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 1 \- Low Risk: 80 **Notable Neighbor:** \- 216.73.163.2: Risk Score 60, Authority Score 50 (Elevated) The subnet exhibits minimal abuse density with a single medium-risk neighbor. The target IP does not inherit significant risk from adjacent addresses. \--- \## Historical Trend Analysis **Observation Count:** 19 total signals observed **Most Recent Activity:** July 28, 2026 **Key Historical Indicators:** \- **Classification:** Clean \- **Abuse Density:** 0.0244 (consistent) \- **Inherited Risk:** 0 \- **Ownership Changes:** 0 (stable) \- **Threat Persistence:** 0 days \- **Campaign Likelihood:** None **Geolocation Anomaly:** Multiple historical probes indicate geolocation validation failures. Claims show San Francisco coordinates (37.2379, -121.7946) with an 8,865.6km distance from probe origin, resulting in RTT violations (83ms observed vs. 177.3ms minimum possible). This suggests either misconfigured geolocation data or proxy usage patterns. \--- \## Relationships **Network Associations:** \- 4 relationships identified, all categorized as "Same Network" \- Target: PFX-EXPRESSVPN (network-level association) \- No external hostname, organization, or certificate relationships detected \--- \## Recommended Actions **For SOC Analysts:** 1. **Monitor:** Continue standard monitoring due to VPN network classification and geolocation anomalies 2. **Investigate:** Review traffic patterns if connections originate from unexpected geographic locations 3. **Block:** No immediate blocking required; risk score remains low (25) 4. **Alert:** Trigger alerts only if risk score increases above 50 or threat indicators emerge **Firewall/IDS Rules:** \- No specific blocking rules recommended at this time \- Standard VPN traffic rules applicable \--- \## Conclusion IP 216.73.163.30 presents a low-risk threat profile with no current malicious indicators. The address operates within a VPN service infrastructure (PFX-EXPRESSVPN) and exhibits stable ownership with minimal neighborhood risk. Primary concerns are geolocation validation anomalies and the absence of service exposure, which may indicate proper firewalling but also potential misconfiguration. No immediate action required beyond routine monitoring. **Threat Level:** LOW **Action Required:** Monitor ## Nearby addresses - 216.73.163.2 (https://ipdebrief.com/216.73.163.2) - 216.73.163.4 (https://ipdebrief.com/216.73.163.4) - 216.73.163.6 (https://ipdebrief.com/216.73.163.6) - 216.73.163.7 (https://ipdebrief.com/216.73.163.7) - 216.73.163.10 (https://ipdebrief.com/216.73.163.10) - 216.73.163.11 (https://ipdebrief.com/216.73.163.11) - 216.73.163.12 (https://ipdebrief.com/216.73.163.12) - 216.73.163.13 (https://ipdebrief.com/216.73.163.13) - 216.73.163.16 (https://ipdebrief.com/216.73.163.16) - 216.73.163.20 (https://ipdebrief.com/216.73.163.20) - 216.73.163.22 (https://ipdebrief.com/216.73.163.22) - 216.73.163.24 (https://ipdebrief.com/216.73.163.24) --- Source: IPDebrief, "216.73.163.30 IP intelligence", https://ipdebrief.com/216.73.163.30, updated 2026-09-05. Assessments are probabilistic.