# 198.235.24.208 — IP Intelligence Summary 198.235.24.208 is an IPv4 address operated by Palo Alto Networks, Inc (AS396982), geolocated to New York, United States. As of October 5, 2026, IPDebrief rates it Moderate Risk (55/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/198.235.24.208 - Last updated: 2026-10-05 ## Ownership - Organization: Palo Alto Networks, Inc - Network name: PAN-22 - Allocated block: 198.235.24.0/24 - ASN: AS396982 (https://ipdebrief.com/asn/396982) - Regional registry: ARIN ## Location - City: New York - Region: CA - Country: United States - Time zone: — ## Network classification - Infrastructure type: — - Datacenter / hosting: no - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (55/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative **INTELLIGENCE BRIEFING: 198.235.24.208/32** \--- **SUBJECT:** Network Intelligence Assessment **CLASSIFICATION:** Internal Security Use **DATE:** 2026-07-28 \--- \### EXECUTIVE SUMMARY The IP address 198.235.24.208 is assigned to Palo Alto Networks, Inc. (ASN 396982) within the PAN-22 network block (198.235.24.0/24). Current risk assessment indicates moderate risk (55/100) with no active malicious indicators detected. The address resolves to New York, NY geolocation but shows inconsistent coordinate data. \--- \### OWNERSHIP AND NETWORK CLASSIFICATION **Organization:** Palo Alto Networks, Inc **ASN:** 396982 **Network Name:** PAN-22 **CIDR Block:** 198.235.24.0/24 **RIR:** ARIN **Registration Date:** Not available **Abuse Contact:** Available via RDAP The IP is classified as a corporate infrastructure address with no public-facing services detected. Network classification indicates "Firewalled / No Services." \--- \### GEOLOCATION DATA **Country:** United States (US) **Region:** US-NY **City:** New York **Coordinates:** 39.83, -98.58 (inconsistent with reported city) **Accuracy Radius:** 2,500 km **Geo-Consensus:** Yes (2 sources) \--- \### THREAT INDICATORS **Risk Score:** 55/100 (Moderate Risk) **Abuse Confidence:** Not applicable **Blacklist Status:** Listed on 3 of 8 DNSBLs **Known Campaigns:** None detected **Threat Feeds:** Empty **Positive Indicators:** \- Not a Tor exit node \- Not flagged as a known attacker \- No spam source indicators \- No honeypot hits recorded \- No enumeration strikes detected \- No WAF violations observed \--- \### SERVICE AND PORT ANALYSIS **Open Ports:** None detected **TLS Certificate:** Not available **HTTP Title:** Not available **Server Banner:** Not available **Service Purpose:** Firewalled / No Services No active services are publicly accessible on this IP address. \--- \### NEIGHBORHOOD ANALYSIS **Subnet:** 198.235.24.0/24 **Total Sibling IPs:** 34 **Active Siblings:** 20 **Abuse Density:** 0.0882 **Risk Distribution:** \- High Risk: 0 \- Medium Risk: 28 \- Low Risk: 5 Notable high-risk neighbors include: \- 198.235.24.194 (Risk: 65) \- 198.235.24.219 (Risk: 65) \--- \### SIGNAL OBSERVATION HISTORY Total observations: 16 Most recent observation: 2026-07-28 **Key Historical Signals:** \- Subnet classification: "mostly_clean" \- Inherited risk: 3/100 \- Ownership changes: 0 \- Threat persistence days: 0 \- Is persistently malicious: No No significant changes observed in threat profile over time. \--- \### RELATIONSHIP GRAPH **Detected Relationships:** 2 \- Same Network: PAN-22 \- Same Network: PAN-22 No additional relationships detected to organizations, hostnames, or certificates. \--- \### RECOMMENDED ACTIONS **Monitoring Recommendations:** \- Increase logging verbosity and review recent activity from this IP \- Monitor for any changes in service exposure \- Track DNSBL listing status **Firewall Rules (for immediate consideration):** \`\`\`bash \# iptables iptables -A INPUT -s 198.235.24.208 -j DROP \# nftables nft add rule inet filter input ip saddr 198.235.24.208 drop \# nginx deny 198.235.24.208; \# pfSense 198.235.24.208/32 \# Cloudflare WAF Action: Block Filter: ip.src eq 198.235.24.208 \# AWS WAF Addresses: 198.235.24.208/32 \`\`\` \--- \### ANALYST NOTES This IP belongs to a legitimate enterprise network (Palo Alto Networks) but maintains a moderate risk score primarily due to DNSBL listings. The absence of active services and no malicious indicators suggests defensive configuration rather than malicious activity. However, the elevated risk score (55/100) and DNSBL presence warrant continued monitoring. The neighborhood analysis shows 28 of 33 sibling IPs at medium risk, indicating the /24 block may have elevated activity overall. **Recommended Action:** Block at perimeter firewall with continued monitoring for any behavioral changes. ## Nearby addresses - 198.235.24.25 (https://ipdebrief.com/198.235.24.25) - 198.235.24.36 (https://ipdebrief.com/198.235.24.36) - 198.235.24.39 (https://ipdebrief.com/198.235.24.39) - 198.235.24.40 (https://ipdebrief.com/198.235.24.40) - 198.235.24.41 (https://ipdebrief.com/198.235.24.41) - 198.235.24.44 (https://ipdebrief.com/198.235.24.44) - 198.235.24.48 (https://ipdebrief.com/198.235.24.48) - 198.235.24.52 (https://ipdebrief.com/198.235.24.52) - 198.235.24.54 (https://ipdebrief.com/198.235.24.54) - 198.235.24.58 (https://ipdebrief.com/198.235.24.58) - 198.235.24.64 (https://ipdebrief.com/198.235.24.64) - 198.235.24.65 (https://ipdebrief.com/198.235.24.65) --- Source: IPDebrief, "198.235.24.208 IP intelligence", https://ipdebrief.com/198.235.24.208, updated 2026-10-05. Assessments are probabilistic.