netcup IP Ranges
netcup GmbH sells virtual and dedicated servers out of Karlsruhe, and has belonged to the Austrian Anexia group since Anexia announced the acquisition on 16 November 2016. Its RIPE aut-num, AS197540, was created on 26 January 2011 and still carries the original remark describing netcup as a webhosting provider in germany. The organisation object behind it, ORG-nG51-RIPE, is a RIPE LIR registered at Emmy-Noether-Strasse 10 in Karlsruhe.
- Provider
- netcup
- Primary ASN
- AS197540
- Category
- Hosting
- Headquarters
- Karlsruhe, Germany
- Announced IPv4 prefixes
- 240
- Registry
- RIPE
Known IP ranges
These prefixes are currently announced to the global routing table by AS197540 (netcup-AS netcup GmbH). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
37.120.160.0/19
152.53.128.0/20
188.68.32.0/20
5.45.96.0/20
46.38.224.0/20
37.120.160.0/20
202.61.224.0/20
37.120.184.0/21
37.221.192.0/21
46.38.240.0/21
2a04:b500::/32
2a0f:5b00::/32
2a03:4000::/32 (IPv6)
What does a netcup IP mean in a privacy test?
An address here is a machine somebody rents by the month, so the useful question is not whether it is datacentre space but whether the renter ever configured it. netcup gives each server a default reverse name shaped as the letter v followed by a long run of digits, on one of several of its own domains: bestsrv.de, happysrv.de and luckysrv.de all appear in live lookups, and the set is not closed. An address still answering with one of those has had nothing deliberately set on it. Addresses resolving to a real domain instead were named by the customer, and that says far more about what the machine is for than the ASN can. A third case is netcup's own kit, which answers as netcup.de rather than as a numbered server slot.
netcup publishes a looking glass, not a range list
There is no geofeed and no published address list. The allocations checked here - 37.120.160.0/19, 5.45.96.0/20, 202.61.224.0/20 and 152.53.128.0/20 - carry no geofeed attribute. What netcup does publish is a looking glass at lg.netcup.net and an IRR AS-SET, AS-NETCUP. Its PeeringDB record adds a detail worth having: the network is filed under the name netcup GmbH with the tag powered by ANX, classed Content with a mostly outbound ratio and a European scope, and its note says netcup is a member of the Anexia group, is no longer accepting peering requests, and directs them to AS47147 instead.
That leaves the RIPE record as the source for attribution, and the thing to know is that a netcup address does not always come back netcup. All four of the blocks above sit under the same organisation, ORG-nG51-RIPE, but the netnames, statuses and maintainers diverge sharply. 37.120.160.0/19 and 5.45.96.0/20 are ALLOCATED PA under NETCUP-MNT with netnames DE-NETCUP-20120213 and DE-NETCUP-20120524. 202.61.224.0/20 is ASSIGNED PA, maintained by ANEXIA-MNT, netname NETCUP-NETWORK-202-61-224-0-20, described as powered by ANX. 152.53.128.0/20 is SUB-ALLOCATED PA under an Anexia holding netname, AT-ANXHOLDING2-20210908, maintained by ANEXIA-MNT and NETCUP-MNT together, and originated by AS197540 and Anexia's AS42473 both.
Default hostname, customer hostname, or netcup's own
There are three states and they mean different things. A default netcup name - v2202507286616360909.bestsrv.de on 152.53.140.20, v220250485509331532.happysrv.de on 188.68.40.30, v2202408230667280205.luckysrv.de on 37.120.160.30 - is an untouched server: the letter v, a long digit string, and one of netcup's rotating server domains. A customer-set name means somebody went into the control panel and declared what the box is for, and it can be any domain at all, which is why a whois that says Karlsruhe and a hostname that says something else are not in conflict. No PTR is the third state.
netcup's own infrastructure is the one case where the name is neither generated nor arbitrary: 46.38.224.30 answers as www.netcup.de. A hostname in the company's own domain is netcup itself; a numbered bestsrv.de or luckysrv.de name is a rented slot nobody has configured; anything else is the tenant speaking. Because each address maps to one server rather than to a pool, the same address on two different days is usually the same machine, right up until the customer cancels and it is reissued - which is the ordinary reason a previously quiet netcup address starts behaving badly.
Related tools
Frequently asked questions
Who owns netcup?
Anexia, the Austrian IT company, which announced the acquisition on 16 November 2016. Anexia said at the time that there were no major plans to integrate netcup, that netcup would remain largely independent, and that it stays a German company with its existing German data centre site continuing to operate. The RIPE organisation object is still a netcup GmbH LIR at Emmy-Noether-Strasse 10 in Karlsruhe.
What does a hostname like v2202408230667280205.luckysrv.de mean?
It is netcup's default reverse name for a server the customer has not renamed. The format is the letter v, a long digit string, and one of netcup's own server domains - bestsrv.de, happysrv.de and luckysrv.de all occur in live lookups. It identifies the server slot, not the customer, and it tells you nothing has been deliberately configured.
Why does a whois on a netcup address return Anexia?
Because netcup is in the Anexia group and some of the space AS197540 originates is filed on the Anexia side. 152.53.128.0/20 is SUB-ALLOCATED PA with the netname AT-ANXHOLDING2-20210908 and is originated by both AS197540 and Anexia's AS42473; 202.61.224.0/20 is described powered by ANX and maintained by ANEXIA-MNT. All of it still sits under the same RIPE organisation, ORG-nG51-RIPE.
Does netcup publish a geofeed?
No. None of its allocations checked here carries a geofeed attribute or a geofeed URL in remarks. The RIPE record is the published source, and it places these allocations in DE without going to city level.
Is a netcup address a VPN exit?
It can be, and the ASN cannot tell you. netcup rents servers and what a customer runs on one is up to them, so some netcup addresses carry VPN or proxy exits and most do not. The reverse name is the better clue: an untouched default hostname on bestsrv.de or luckysrv.de declares nothing, while a customer-set name at least states an intended purpose.