# 37.140.254.251 — IP Intelligence Summary

37.140.254.251 is an IPv4 address operated by ExpressVPN (AS206092), geolocated to Zurich, Netherlands. As of October 24, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/37.140.254.251
- Last updated: 2026-10-24

## Ownership

- Organization: ExpressVPN
- Network name: NL-LAYERSWITCH1-20210921
- Allocated block: 37.140.254.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: RIPE

## Location

- City: Zurich
- Region: Zurich
- Country: Netherlands
- Time zone: Europe/Amsterdam

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (50/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 37.140.254.251

\## Executive Summary

IP address 37.140.254.251 is associated with ExpressVPN and operates from the Netherlands (NL) within the 37.140.254.0/24 subnet. Overall risk profile is LOW with a risk score of 25/100. No active threat indicators detected. The IP is currently firewalled with no accessible services.

\---

\## Profile Overview

\- **Risk Score**: 25 (Low Risk)

\- **Location**: Zurich, Netherlands (NL)

\- **Organization**: ExpressVPN

\- **ASN**: 206092 (origin)

\- **Service Status**: Firewalled / No Services

\- **Network Classification**: Residential/VPN infrastructure

\## Threat Assessment

\- **Blacklist Status**: 0 blacklists (not currently listed)

\- **DNSBL Status**: Listed on 1 of 8 threat feeds (dnsblListedCount: 1)

\- **Tor Exit Node**: No

\- **Known Attacker**: No

\- **Spam Source**: No

\- **Campaign Affiliation**: None detected

\## Network & Infrastructure

\- **Subnet**: 37.140.254.0/24 (256 addresses)

\- **Subnet Classification**: Mostly clean (abuse density: 0.2)

\- **Threat Siblings in Subnet**: 4 out of 20 IPs show threat indicators

\- **Route Stability**: Not stable (routeChanges30d: 0, but isRouteStable: false)

\- **Control Plane**: RPKI state pending, IRR consistency pending

\## Observation History (13 signals observed)

Recent intelligence signals include:

\- Organization attribution: ExpressVPN (confidence: 0.90-0.95)

\- Abuse contact: abuse-reports@vpnconsumer.com

\- Geolocation consensus: Netherlands (multiple sources)

\- One DNSBL listing with high severity rating

\## Neighborhood Analysis

The 37.140.254.0/24 subnet contains 19 additional monitored IPs:

\- **Risk Distribution**: 19 low-risk, 0 medium-risk, 0 high-risk

\- **Abuse Density**: 0%

\- **Notable Pattern**: Multiple sibling IPs (including 37.140.254.9, 37.140.254.51, 37.140.254.100) share identical risk score 25 and authority score 50, indicating coordinated infrastructure

\## Recommended Security Actions

Based on the low-risk profile and VPN association, standard defensive posture is appropriate. No specific blocking required unless the IP appears in active threat campaigns or exhibits anomalous behavior.

\### Suggested Rules

\- **Allow** if legitimate VPN traffic observed

\- **Monitor** for port scanning or unusual connection patterns

\- **Block** only if specific threat intelligence correlates with this IP

\## Intelligence Notes

The IP demonstrates characteristics of legitimate VPN infrastructure with stable ownership (ExpressVPN). The single DNSBL listing may represent historical abuse or false positive. The subnet shows low abuse density despite 4 threat siblings, suggesting isolated incidents rather than coordinated abuse. No relationship graph connections detected (no certificates, domains, or related entities linked).

## Nearby addresses

- 37.140.254.9 (https://ipdebrief.com/37.140.254.9)
- 37.140.254.51 (https://ipdebrief.com/37.140.254.51)
- 37.140.254.100 (https://ipdebrief.com/37.140.254.100)
- 37.140.254.118 (https://ipdebrief.com/37.140.254.118)
- 37.140.254.122 (https://ipdebrief.com/37.140.254.122)
- 37.140.254.135 (https://ipdebrief.com/37.140.254.135)
- 37.140.254.138 (https://ipdebrief.com/37.140.254.138)
- 37.140.254.141 (https://ipdebrief.com/37.140.254.141)
- 37.140.254.142 (https://ipdebrief.com/37.140.254.142)
- 37.140.254.154 (https://ipdebrief.com/37.140.254.154)
- 37.140.254.157 (https://ipdebrief.com/37.140.254.157)
- 37.140.254.168 (https://ipdebrief.com/37.140.254.168)

---

Source: IPDebrief, "37.140.254.251 IP intelligence", https://ipdebrief.com/37.140.254.251, updated 2026-10-24. Assessments are probabilistic.