# 91.230.225.46 — IP Intelligence Summary

91.230.225.46 is an IPv4 address operated by ExpressVPN (AS206092), geolocated to London, Netherlands. As of August 29, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/91.230.225.46
- Last updated: 2026-08-29

## Ownership

- Organization: ExpressVPN
- Network name: NL-NETROUTING-20210920
- Allocated block: 91.230.225.0/24
- ASN: AS206092 (https://ipdebrief.com/asn/206092)
- Regional registry: RIPE

## Location

- City: London
- Region: England
- Country: Netherlands
- Time zone: Europe/Amsterdam

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 91.230.225.46

**Classification:** LOW RISK | **Analysis Date:** 2026-07-24

\## Executive Summary

IP 91.230.225.46 is a low-risk residential/proxy endpoint associated with ExpressVPN infrastructure. The IP shows no active threat indicators, no open services, and zero blacklist entries. Current risk assessment indicates minimal threat posture.

\## Ownership & Geolocation

\- **Organization:** ExpressVPN

\- **Netname:** NL-NETROUTING-20210920

\- **ASN:** Not resolved

\- **RIR:** RIPE

\- **Country:** NL (Netherlands)

\- **Geolocation Discrepancy:** Geolocation database reports coordinates (52.13, 5.29) suggesting location in Republica de Panama, which contradicts Netherlands registration. This indicates potential geolocation spoofing common with VPN services.

\## Threat Assessment

\- **Risk Score:** 0 (Low Risk)

\- **Abuse Confidence Score:** Not reported

\- **Blacklist Count:** 0

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Active Threat Indicators:** None detected

\- **Known Campaigns:** None

\## Network Services & DNS

\- **Open Ports:** None detected (Firewalled / No Services)

\- **DNS Records:** No PTR hostnames, no forward resolution, no email authentication (SPF/DMARC)

\- **HTTP/TLS Services:** None active

\- **Certificate Data:** Not applicable

\## Neighborhood Analysis (91.230.225.0/24)

\- **Subnet Size:** 67 total IP addresses

\- **Abuse Density:** 0%

\- **Risk Distribution:** 66 low-risk, 1 medium-risk (91.230.225.26-32 range), 0 high-risk

\- **Threat Siblings:** None identified

\- **Classification:** Subnet appears to be a relatively clean VPN infrastructure block

\## Observation History

Seven signal observations recorded as of 2026-07-24. Key findings:

\- Ownership signals consistently identify ExpressVPN with RIPE registration

\- Geolocation signals show NL registration with Panama coordinate mismatch

\- No historical escalation in threat signals observed

\- No pattern of persistent malicious activity detected

\## Relationships

\- **Same Network:** NL-NETROUTING-20210920 (ExpressVPN infrastructure)

\- **No external entity correlations detected**

\## Recommended Actions

Based on current risk profile (Risk Score: 0), no specific firewall or blocking actions are recommended. The IP represents a standard VPN endpoint without active threat characteristics.

**Suggested SOC Response:** Monitor but no immediate action required. If this IP appears in logs, treat as benign VPN traffic unless other contextual indicators suggest otherwise.

\---

*Data sources: IPDebrief intelligence platform. Analysis based on current signal data and historical observations.*

## Nearby addresses

- 91.230.225.15 (https://ipdebrief.com/91.230.225.15)
- 91.230.225.16 (https://ipdebrief.com/91.230.225.16)
- 91.230.225.26 (https://ipdebrief.com/91.230.225.26)
- 91.230.225.27 (https://ipdebrief.com/91.230.225.27)
- 91.230.225.29 (https://ipdebrief.com/91.230.225.29)
- 91.230.225.30 (https://ipdebrief.com/91.230.225.30)
- 91.230.225.31 (https://ipdebrief.com/91.230.225.31)
- 91.230.225.32 (https://ipdebrief.com/91.230.225.32)
- 91.230.225.33 (https://ipdebrief.com/91.230.225.33)
- 91.230.225.37 (https://ipdebrief.com/91.230.225.37)
- 91.230.225.38 (https://ipdebrief.com/91.230.225.38)
- 91.230.225.40 (https://ipdebrief.com/91.230.225.40)

---

Source: IPDebrief, "91.230.225.46 IP intelligence", https://ipdebrief.com/91.230.225.46, updated 2026-08-29. Assessments are probabilistic.