178.244.207.98
## Intelligence Briefing: 178.244.207.98/32
Classification: Moderate Risk – Defensively Monitored
Date: 2026-07-26
Risk Score: 40/100
Analyst: SOC Intelligence Unit
---
Ownership & Geographic Profile
The IP address 178.244.207.98 is assigned to Turkcell IP Manager (ASN 16135) under the TR-TURKCELL-INTERNET network block (178.244.0.0/14). Registration is through RIR RIPE. Geolocation consensus places the endpoint in Ankara, Turkey (39.96°N, 32.79°E), though historical observations indicate Kartal, Istanbul. The IP operates under Europe/Istanbul timezone.
Network Classification & Service Status
The endpoint is classified as clean with no active services detected. Network scanning indicates a firewalled state with no open ports and no TLS certificates. The control plane shows route instability (isRouteStable=false) with zero route changes observed in the past 30 days. DNSSEC is valid, with the IP listed on 2 of 8 DNSBL feeds.
Threat Indicators
No active threat indicators were identified. The IP is not flagged as a Tor exit node, known attacker, or spam source. Abuse confidence score is unavailable. Zero correlation with known threat campaigns. Threat observation count stands at zero, and the IP is not persistently malicious.
Neighborhood & Subnet Analysis
The /24 neighborhood (178.244.207.98/24) shows zero abuse density with a clean classification. No active sibling IPs were detected. The subnet contains one total sibling with no threat siblings identified.
Behavioral History
Thirteen observations were recorded, most recently on 2026-07-26. Signals indicate consistent geolocation data with geoPlausible validation enabled. One observation noted ICMP blocking preventing TTL validation. Ownership has remained stable with no changes recorded. Threat persistence days stand at zero.
Relationship Graph
A single relationship exists: the IP shares network infrastructure with TR-TURKCELL-INTERNET. No additional relationships to organizations, hostnames, certificates, or subnets were identified.
Recommended Security Actions
Based on the risk profile, the following firewall rules are recommended:
- iptables: `iptables -A INPUT -s 178.244.207.98 -j DROP`
- nftables: `nft add rule inet filter input ip saddr 178.244.207.98 drop`
- Cloudflare WAF: Block with expression `ip.src eq 178.244.207.98`
- AWS WAF: Add `178.244.207.98/32` to IP set for blocking
---
Intelligence Assessment
The IP 178.244.207.98 presents moderate risk due to DNSBL listings and route instability, despite lacking active threat indicators or open services. The endpoint is part of a Turkcell-managed subnet with clean neighborhood metrics. While no active exploitation is observed, the risk score of 40 warrants defensive monitoring. No immediate threat correlation exists, but continued observation is recommended given the route instability flag.
Priority: Low to Medium
Recommended Action: Monitor with existing firewall rules; no immediate threat escalation required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Turkcell IP Manager |
| ASN | AS16135 |
| Network Name | TR-TURKCELL-INTERNET |
| CIDR Block | 178.244.0.0/14 |
| RIR | RIPE |
| Country | TR |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS16135 |
| Network Prefix | 178.244.192.0/20 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 0% | 0 | 0 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 16% | 4 | 4 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-11 02:18:04 UTC |
| Last Seen | 2026-09-01 01:05:16 UTC |
| Profile Built | 2026-08-30 21:34:19 UTC |
| Data Freshness | Live |
| Signal Types | 17 |
| Total Observations | 18 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 178.244.207.98
Who owns the IP address 178.244.207.98?
178.244.207.98 is registered to Turkcell IP Manager. The address falls within the 178.244.0.0/14 network block. Registration is held at RIPE.
Where is 178.244.207.98 located?
Geolocation data places 178.244.207.98 in Ankara, Ankara, Turkey. The local time zone is Europe/Istanbul. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 178.244.207.98 malicious or safe?
178.244.207.98 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.