Vodafone Germany IP Ranges

Known IP ranges

These prefixes are currently announced to the global routing table by AS3209 (VODANET Vodafone GmbH). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.

88.64.0.0/12
188.96.0.0/12
178.0.0.0/12
47.64.0.0/13
2.200.0.0/13
94.216.0.0/13
92.72.0.0/13
84.56.0.0/13
109.40.0.0/13
95.88.0.0/14
2a00::/22
2a02:8100::/27
2a0d:240::/29 (IPv6)

What does a Vodafone Germany IP mean in a privacy test?

An address here is a German line, but the AS number alone will not say what kind. Vodafone folded its cable networks into this one: the RIPE record for AS31334, the old Kabel Deutschland number, now states that it is fully integrated into AS3209 and directs all requests to a peering address on 3209. So Arcor-era DSL, Kabel Deutschland cable, Kabel BW cable and mobile data sessions all leave through the same autonomous system, and a lookup that reports Vodafone GmbH has narrowed almost nothing. Reverse DNS is the only public signal that separates them, because Vodafone publishes nothing per block that would do it better, and each of the four access networks kept a naming convention of its own. Whois narrows it a second way, because the netname and the organisation object still name the company the block was allocated to rather than the brand it is sold under today.

What Vodafone Germany publishes, and what it leaves out

There is no geofeed and no published allowlist here. The geofeed: attribute RFC 9092 defines for whois records is absent from the RIPE inetnums covering this network, 88.64.0.0/12 and 47.64.0.0/13 among them, so the registry objects themselves are the entire machine-readable picture. They carry more than usual, because Vodafone kept the netname conventions it inherited: fixed-line allocations begin DE-ARCOR-, Kabel Deutschland cable begins DE-KABELDEUTSCHLAND-, Kabel BW cable begins DE-KABELBW-, mobile begins DE-D2VODAFONE-, and each is followed by the date of the allocation, so the netname sorts a block into an access technology and an era before anything else is checked. The two cable estates also sit under organisation objects of their own, ORG-KDBS1-RIPE and ORG-KBGC1-RIPE, rather than the ORG-MAT1-RIPE that holds the rest.

The routing side is published as an IRR object rather than as a document. The AS-SET Vodafone names in its own PeeringDB entry is AS-ARCORGLOBAL, described in the RIPE database as a global AS-MACRO supported by Vodafone and maintained by ARCOR-MNT; its membership is two further sets, AS-ARCOR and AS-KDG, which is the fixed-line and cable split written straight into the filtering. That object was last modified in January 2019, which is worth knowing before treating it as a current inventory. Contacts are the part that is stated plainly: the RIPE record for AS31334 gives abuse.de@vodafone.com and sends all requests to peering.3209@Vodafone.com, and the organisation object points at the abuse role ANOC1-RIPE.

Which Vodafone line an address is on, from the hostname

Four naming conventions live on this one AS number, and each belongs to a different access network. Arcor-era DSL resolves as dslb-088-064-010-005.088.064.pools.vodafone-ip.de, with the four octets zero-padded and written out twice. The Kabel BW estate uses the same domain with its own label, ip-046-005-010-005.um12.pools.vodafone-ip.de - note that the label does not match the netname, which is DE-KABELBW-20100902, so trust the registry over the hostname when they disagree. Kabel Deutschland cable kept its own domain and encodes the address in hexadecimal instead, so 95.88.10.5 becomes ip5f580a05.dynamic.kabel-deutschland.de. Mobile sessions answer in a fourth form, ip-109-40-10-5.web.vodafone.de, unpadded and on the domain of the mobile internet access point.

All four are generated from the address itself, and that is the limitation worth holding on to: the name gives the access technology and nothing about the person, and it answers whether or not anything is listening, so a working lookup is never evidence of a reachable host. Newer space has no name at all - a reverse lookup inside 47.64.0.0/13 returns NXDOMAIN - which says only that the block was never added to the pool zones. To find a business rather than a household, query whois for the exact address rather than the parent block: Vodafone's large allocations are marked ALLOCATED PA, and a company that has been given a slice of one shows up as a more specific inetnum with its own netname inside it, marked ASSIGNED PA. Where nothing more specific exists, the line terminates on Vodafone's own access network and the abuse contact is Vodafone's.

Related tools

Frequently asked questions