91.230.225.46📋 Copy

# IP Intelligence Briefing: 91.230.225.46

Classification: LOW RISK | Analysis Date: 2026-07-24

## Executive Summary

IP 91.230.225.46 is a low-risk residential/proxy endpoint associated with ExpressVPN infrastructure. The IP shows no active threat indicators, no open services, and zero blacklist entries. Current risk assessment indicates minimal threat posture.

## Ownership & Geolocation

• Organization: ExpressVPN
• Netname: NL-NETROUTING-20210920
• ASN: Not resolved
• RIR: RIPE
• Country: NL (Netherlands)
• Geolocation Discrepancy: Geolocation database reports coordinates (52.13, 5.29) suggesting location in Republica de Panama, which contradicts Netherlands registration. This indicates potential geolocation spoofing common with VPN services.

## Threat Assessment

• Risk Score: 0 (Low Risk)
• Abuse Confidence Score: Not reported
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Indicators: None detected
• Known Campaigns: None

## Network Services & DNS

• Open Ports: None detected (Firewalled / No Services)
• DNS Records: No PTR hostnames, no forward resolution, no email authentication (SPF/DMARC)
• HTTP/TLS Services: None active
• Certificate Data: Not applicable

## Neighborhood Analysis (91.230.225.0/24)

• Subnet Size: 67 total IP addresses
• Abuse Density: 0%
• Risk Distribution: 66 low-risk, 1 medium-risk (91.230.225.26-32 range), 0 high-risk
• Threat Siblings: None identified
• Classification: Subnet appears to be a relatively clean VPN infrastructure block

## Observation History

Seven signal observations recorded as of 2026-07-24. Key findings:

• Ownership signals consistently identify ExpressVPN with RIPE registration
• Geolocation signals show NL registration with Panama coordinate mismatch
• No historical escalation in threat signals observed
• No pattern of persistent malicious activity detected

## Relationships

• Same Network: NL-NETROUTING-20210920 (ExpressVPN infrastructure)
• No external entity correlations detected

## Recommended Actions

Based on current risk profile (Risk Score: 0), no specific firewall or blocking actions are recommended. The IP represents a standard VPN endpoint without active threat characteristics.

Suggested SOC Response: Monitor but no immediate action required. If this IP appears in logs, treat as benign VPN traffic unless other contextual indicators suggest otherwise.

---

*Data sources: IPDebrief intelligence platform. Analysis based on current signal data and historical observations.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.