# 37.140.254.250 — IP Intelligence Summary

37.140.254.250 is an IPv4 address operated by ExpressVPN (AS206092), geolocated to Zurich, Netherlands. As of November 6, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/37.140.254.250
- Last updated: 2026-11-06

## Ownership

- Organization: ExpressVPN
- Network name: NL-LAYERSWITCH1-20210921
- Allocated block: 37.140.254.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: RIPE

## Location

- City: Zurich
- Region: Zurich
- Country: Netherlands
- Time zone: Europe/Amsterdam

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (50/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING

**Target:** 37.140.254.250/32

**Date:** 2026-07-24

**Classification:** Defensive Intelligence Report

\---

\## EXECUTIVE SUMMARY

IP address 37.140.254.250 is a low-risk endpoint associated with ExpressVPN infrastructure. The IP presents minimal threat indicators and is classified within a generally clean subnet. No immediate blocking action is recommended unless specific contextual intelligence suggests otherwise.

\---

\## RISK PROFILE

| Metric | Value | Assessment |

|--------|-------|------------|

| Risk Score | 25/100 | Low Risk |

| Provider Score | 0 | Clean |

| Authority Score | 0 | Clean |

| Stability Score | 0 | N/A |

| Abuse Confidence | N/A | Not applicable |

**Threat Classification:** No active threat indicators detected. IP is not flagged as Tor exit node, known attacker, or spam source. Zero blacklist hits in active feeds.

\---

\## OWNERSHIP & INFRASTRUCTURE

**Organization:** ExpressVPN

**ASN:** 206092

**NetName:** NL-LAYERSWITCH1-20210921

**CIDR Block:** 37.140.254.0/24

**RIR:** RIPE

**Country:** Netherlands (NL)

**GeoLocation:** Zurich (52.13°N, 5.29°E)

**Timezone:** Europe/Amsterdam

**Network Role:** Firewalled / No Services

**Infrastructure Type:** VPN Infrastructure

**Anycast:** No

**Cloud/CDN:** No

\---

\## NETWORK SERVICES ANALYSIS

**Open Ports:** None detected

**TLS Certificate:** None

**HTTP Banner:** None

**Service Purpose:** Firewalled / No Services

This endpoint shows no active services, consistent with VPN infrastructure that may not respond to standard service probes.

\---

\## DNS REPUTATION

**PTR Hostnames:** None

**Forward Resolution:** Not confirmed

**Hosted Domains:** 0

**Email Authentication:**

\- SPF: Not configured

\- DMARC: Not configured

\- TXT Records: 0

**DNSBL Status:** Listed on 1 of 8 total DNSBL lists

\---

\## NEIGHBORHOOD ANALYSIS (37.140.254.0/24)

**Abuse Density:** 0.2 (20%)

**Classification:** mostly_clean

**Total Siblings:** 20

**Active Siblings:** 0

**Threat Siblings:** 4

**Risk Distribution Across Subnet:**

\- High Risk: 0 IPs

\- Medium Risk: 0 IPs

\- Low Risk: 19 IPs

The subnet shows minimal abuse concentration with the majority of addresses presenting low-risk profiles.

\---

\## OBSERVATION HISTORY

**Total Observations:** 14 signals captured

**Recent Activity:**

\- **Geolocation:** Consistent NL positioning with average RTT of 110.2ms

\- **Ownership:** ExpressVPN confirmed across multiple probes

\- **ASN Detection:** RIPE registry attribution verified

\- **Subnet Classification:** "mostly_clean" classification observed

\- **Abuse Density:** Consistent 0.2 metric across observations

**Temporal Stability:** No ownership changes detected. No threat persistence observed.

\---

\## RELATIONSHIP GRAPH

**Related Entities:**

\- Same Network: NL-LAYERSWITCH1-20210921 (2 relationships)

\---

\## TRACEROUTE ANALYSIS

**Hop Count:** 14

**First Hop RTT:** 0.2ms

**Last Hop RTT:** 110.5ms

**Timed Out Hops:** 3

**Transit Networks:** Comcast

\---

\## RECOMMENDED ACTIONS

**Firewall/Security Recommendations:** None

**Risk-Based Actions:** Monitor but no immediate blocking required

**Suggested Approaches:**

1. **Allow** traffic unless specific contextual intelligence indicates malicious activity

2. **Log** connections for correlation with other threat indicators

3. **Monitor** for service activation or behavioral changes

\---

\## INTELLIGENCE CONCLUSIONS

1. **37.140.254.250** is a legitimate ExpressVPN infrastructure endpoint with low risk profile

2. No active threat indicators or malicious behavior detected

3. Subnet environment shows minimal abuse density (0.2)

4. No recommended blocking actions based on current intelligence

5. Continue monitoring for service activation or behavioral anomalies

**Final Assessment:** LOW RISK — Standard operational VPN infrastructure endpoint requiring no immediate defensive action.

## Nearby addresses

- 37.140.254.9 (https://ipdebrief.com/37.140.254.9)
- 37.140.254.51 (https://ipdebrief.com/37.140.254.51)
- 37.140.254.100 (https://ipdebrief.com/37.140.254.100)
- 37.140.254.118 (https://ipdebrief.com/37.140.254.118)
- 37.140.254.122 (https://ipdebrief.com/37.140.254.122)
- 37.140.254.135 (https://ipdebrief.com/37.140.254.135)
- 37.140.254.138 (https://ipdebrief.com/37.140.254.138)
- 37.140.254.141 (https://ipdebrief.com/37.140.254.141)
- 37.140.254.142 (https://ipdebrief.com/37.140.254.142)
- 37.140.254.154 (https://ipdebrief.com/37.140.254.154)
- 37.140.254.157 (https://ipdebrief.com/37.140.254.157)
- 37.140.254.168 (https://ipdebrief.com/37.140.254.168)

---

Source: IPDebrief, "37.140.254.250 IP intelligence", https://ipdebrief.com/37.140.254.250, updated 2026-11-06. Assessments are probabilistic.