# 37.140.254.248 — IP Intelligence Summary 37.140.254.248 is an IPv4 address operated by ExpressVPN (AS206092), geolocated to Zurich, Netherlands. As of October 23, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/37.140.254.248 - Last updated: 2026-10-23 ## Ownership - Organization: ExpressVPN - Network name: NL-LAYERSWITCH1-20210921 - Allocated block: 37.140.254.0/24 - ASN: AS206092 (https://ipdebrief.com/asn/206092) - Regional registry: RIPE ## Location - City: Zurich - Region: Zurich - Country: Netherlands - Time zone: Europe/Amsterdam ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (50/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 37.140.254.248/32 **Date:** Current Analysis **Classification:** LOW RISK / DEFENSIVE **Target:** 37.140.254.248/32 \--- \## Executive Summary IP address 37.140.254.248 belongs to ExpressVPN (ASN 206092) and is classified as **Low Risk** with a risk score of 25. The IP is firewalled with no active services detected and demonstrates stable ownership characteristics. No threat indicators, abuse reports, or malicious campaign associations have been identified. \--- \## Ownership and Network Context \- **Organization:** ExpressVPN \- **ASN:** 206092 \- **Network:** NL-LAYERSWITCH1-20210921 \- **CIDR Block:** 37.140.254.0/24 \- **Registration Authority:** RIPE NCC \- **Abuse Contact:** Available via RDAP The IP operates within a commercial VPN provider infrastructure, consistent with the organization's service model. \--- \## Geolocation Data \- **Country:** Netherlands (NL) \- **Region/City:** Zurich \- **Coordinates:** 52.13° N, 5.29° E \- **Timezone:** Europe/Amsterdam \- **Location Accuracy:** 150 km radius \- **Geo Consensus:** Validated across multiple sources \--- \## Threat Assessment | Indicator | Status | |-----------|--------| | Reputation | Low Risk | | Risk Score | 25 | | Known Attacker | No | | Spam Source | No | | Tor Exit Node | No | | Blacklist Count | 0 | | Threat Indicators | None | | Campaign Likelihood | None | No malicious activity or threat indicators associated with this address. \--- \## Network Services and DNS \- **Open Ports:** None detected \- **Service Status:** Firewalled / No Services \- **TLS Certificate:** None \- **Forward Resolution:** 0 hostnames \- **DNSSEC:** Valid \- **Email Authentication:** No SPF/DMARC records configured The IP presents no external-facing services and is not configured for email transmission. \--- \## Control Plane Analysis \- **Route Stability:** False \- **BGP Prefix:** 37.140.254.0/24 \- **Operator Score:** 0.1304 (Minimal) \- **DNSBL Listed:** 1 of 8 total lists \- **RPKI State:** Not available \--- \## Neighborhood Analysis (37.140.254.0/24) \- **Total Subnet Siblings:** 20 \- **Active Siblings:** 0 \- **Threat Siblings:** 4 \- **Abuse Density:** 0.2 (Low) \- **Classification:** Mostly Clean \- **Inherited Risk:** 8 The subnet demonstrates minimal abuse density with most sibling IPs maintaining low-risk profiles. Four sibling IPs flagged as threats, representing 20% of the address space. \--- \## Observation History Summary 15 signal observations collected with consistent characteristics: \- **Recent Activity:** 2026-07-24T01:56:36 UTC \- **Geolocation Stability:** Consistent NL/Zurich positioning \- **RTT Consistency:** 104-113 ms average \- **Ownership Changes:** 0 \- **Threat Persistence:** 0 days \- **Is Persistently Malicious:** False Historical data indicates stable network characteristics without emerging threat patterns. \--- \## Relationships Graph \- **Network Relationships:** NL-LAYERSWITCH1-20210921 (repeated entries) \- **Hostname Associations:** None \- **Organizational Links:** None detected \- **Certificate Associations:** None No external relationships beyond the immediate network namespace. \--- \## Recommended Actions **No immediate defensive actions required.** The IP address presents as a legitimate commercial VPN infrastructure endpoint with no active threat indicators. Standard monitoring protocols apply. **Reference:** No firewall rules or blocking recommendations generated based on current risk profile. \--- **Briefing Prepared By:** IP Intelligence Analysis System **Data Source:** IPDebrief Intelligence Platform **Confidence Level:** High (Multiple signal validations) ## Nearby addresses - 37.140.254.9 (https://ipdebrief.com/37.140.254.9) - 37.140.254.51 (https://ipdebrief.com/37.140.254.51) - 37.140.254.100 (https://ipdebrief.com/37.140.254.100) - 37.140.254.118 (https://ipdebrief.com/37.140.254.118) - 37.140.254.122 (https://ipdebrief.com/37.140.254.122) - 37.140.254.135 (https://ipdebrief.com/37.140.254.135) - 37.140.254.138 (https://ipdebrief.com/37.140.254.138) - 37.140.254.141 (https://ipdebrief.com/37.140.254.141) - 37.140.254.142 (https://ipdebrief.com/37.140.254.142) - 37.140.254.154 (https://ipdebrief.com/37.140.254.154) - 37.140.254.157 (https://ipdebrief.com/37.140.254.157) - 37.140.254.168 (https://ipdebrief.com/37.140.254.168) --- Source: IPDebrief, "37.140.254.248 IP intelligence", https://ipdebrief.com/37.140.254.248, updated 2026-10-23. Assessments are probabilistic.