# 37.140.254.249 — IP Intelligence Summary

37.140.254.249 is an IPv4 address operated by ExpressVPN (AS206092), geolocated to Zurich, Netherlands. As of November 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/37.140.254.249
- Last updated: 2026-11-06

## Ownership

- Organization: ExpressVPN
- Network name: NL-LAYERSWITCH1-20210921
- Allocated block: 37.140.254.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: RIPE

## Location

- City: Zurich
- Region: Zurich
- Country: Netherlands
- Time zone: Europe/Amsterdam

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\## IP Intelligence Briefing: 37.140.254.249/32

**Classification:** Low Risk | **Threat Level:** Minimal | **Report Date:** 2026-07-24

\---

\### Executive Summary

IP address 37.140.254.249 is classified as Low Risk with a risk score of 25. The address belongs to ExpressVPN infrastructure (ASN 206092) within the NL-LAYERSWITCH1-20210921 network block. No active threat indicators, malicious campaigns, or confirmed abuse activity were observed. The IP shows no services, no certificates, and no open ports, consistent with firewalled infrastructure.

\---

\### Ownership and Network Context

\- **Organization:** ExpressVPN

\- **ASN:** 206092 (RIPE)

\- **CIDR Block:** 37.140.254.0/24

\- **Netname:** NL-LAYERSWITCH1-20210921

\- **Abuse Contact:** abuse-reports@vpnconsumer.com

\- **Registration:** RIR: RIPE

\---

\### Geolocation Analysis

\- **Primary Location:** Zurich, Netherlands (52.13°N, 5.29°E)

\- **Alternative Signals:** Republica de Panama (47.3643°N, 8.5437°W)

\- **Distance Validation:** 582km from primary location

\- **Network Classification:** Firewalled / No Services

\- **DNSSEC:** Valid

\- **Control Plane:** BGP prefix 37.140.254.0/24; route stability: false

\---

\### Threat Indicators

\- **Risk Score:** 25 (Low)

\- **Blacklist Count:** 0

\- **DNSBL Listings:** 1 of 8 total lists

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Threat Feeds:** Empty

\- **Known Campaigns:** None detected

\---

\### Network Neighborhood Assessment

The /24 subnet (37.140.254.0/24) contains 20 sibling IPs with the following characteristics:

\- **Abuse Density:** 0.2 (Low)

\- **Classification:** Mostly Clean

\- **Inherited Risk:** 8

\- **Threat Siblings:** 4 out of 20

\- **Risk Distribution:** 19 Low Risk, 0 Medium Risk, 0 High Risk

Neighbor risk scores are uniformly 0 or 25, indicating consistent low-risk classification across the subnet.

\---

\### Service and Network Behavior

\- **Open Ports:** None detected

\- **HTTP Services:** None

\- **TLS Certificates:** None

\- **PTR Hostnames:** None

\- **Forward Resolution:** Inactive

\- **Email Authentication:** SPF/DMARC not configured

\- **Honeypot Hits:** 0

\- **WAF Violations:** 0

\---

\### Historical Observations

Total observations recorded: 15

**Recent Signal Summary (2026-07-24):**

\- Ownership: 0 changes observed

\- Geolocation: Consistent Netherlands positioning with validation confidence 0.75-0.95

\- Ownership/Authority: No ownership changes; authority scores remain stable at 50

\- Threat Persistence: 0 days; not persistently malicious

\- Average Ownership Days: Not applicable

\---

\### Recommended Security Actions

No immediate blocking or mitigation actions recommended. The IP presents a low-risk profile consistent with legitimate VPN infrastructure. Standard egress filtering applies if required by policy.

\---

\### Intelligence Assessment

This IP address represents legitimate ExpressVPN infrastructure with no evidence of malicious activity, abuse, or compromised behavior. The subnet shows minimal abuse density and consistent low-risk characteristics. Monitoring should continue at standard rates without elevated scrutiny.

## Nearby addresses

- 37.140.254.9 (https://ipdebrief.com/37.140.254.9)
- 37.140.254.51 (https://ipdebrief.com/37.140.254.51)
- 37.140.254.100 (https://ipdebrief.com/37.140.254.100)
- 37.140.254.118 (https://ipdebrief.com/37.140.254.118)
- 37.140.254.122 (https://ipdebrief.com/37.140.254.122)
- 37.140.254.135 (https://ipdebrief.com/37.140.254.135)
- 37.140.254.138 (https://ipdebrief.com/37.140.254.138)
- 37.140.254.141 (https://ipdebrief.com/37.140.254.141)
- 37.140.254.142 (https://ipdebrief.com/37.140.254.142)
- 37.140.254.154 (https://ipdebrief.com/37.140.254.154)
- 37.140.254.157 (https://ipdebrief.com/37.140.254.157)
- 37.140.254.168 (https://ipdebrief.com/37.140.254.168)

---

Source: IPDebrief, "37.140.254.249 IP intelligence", https://ipdebrief.com/37.140.254.249, updated 2026-11-06. Assessments are probabilistic.