WorldStream IP Ranges
WorldStream describes itself as a Dutch cloud infrastructure provider running its own data centres at Industriestraat 53 in Naaldwijk, selling dedicated servers, bare metal compute and colocation. AS49981 is the number it announces from: a RIPE aut-num created on 1 December 2009, as-name WorldStream, held by WorldStream B.V., whose remarks list Cogent, Arelion, Colt, Orange, Liberty Global and DTAG as its transit. PeeringDB classes the network as Network Services at 1 to 5 Tbps with an open peering policy.
- Provider
- WorldStream
- Primary ASN
- AS49981
- Category
- Hosting
- Headquarters
- Naaldwijk, Netherlands
- Announced IPv4 prefixes
- 115
- Registry
- RIPE
Known IP ranges
These prefixes are currently announced to the global routing table by AS49981 (WorldStream WorldStream B.V.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
190.2.144.0/20
217.23.0.0/20
109.236.80.0/20
175.110.112.0/20
190.2.128.0/20
178.132.0.0/21
93.190.136.0/21
89.38.96.0/22
185.191.0.0/22
45.14.132.0/22
2a0f:9a80::/29
2a06:3880::/29
2a09:9446::/32 (IPv6)
What does a WorldStream IP mean in a privacy test?
An address on AS49981 is a rented machine in a Dutch data centre, and the reverse name usually says so outright: 109.236.85.20 is 109-236-85-20.hosted-by-worldstream.net, 190.2.144.20 is 190-2-144-20.hosted-by-worldstream.net. In a privacy test this is the datacentre answer rather than the residential one, and nothing in the public record narrows it further, because a VPN exit, a scraper, a game server and a mail relay all present identically from outside. Two of the blocks deserve a separate flag. 190.2.144.0/20 is a LACNIC object, reallocated to WorldStream B.V. on 27 November 2017, while 175.110.112.0/20 comes out of 175/8, which IANA allocated to APNIC, yet its object is a RIPE allocation named NL-WORLDSTREAM-20200520 with country NL. A geolocation service that infers a region from which /8 a block came out of will place those machines in Latin America or Asia, while both records say the Netherlands.
What WorldStream registers, and what has gone stale
The published data is routing data, and WorldStream registers it at unusually fine grain. The 109.236.80.0/20 allocation, netname NL-WORLDSTREAM-20091204, is covered not by one route object but by a route for the /20 plus a separate route for each /24 inside it, all origin: AS49981 under MNT-WORLDSTREAM, each repeating the remark that abuse notifications go to abuse at worldstream.nl. Space whose registry object lives outside RIPE is covered in RADB instead: the LACNIC block 190.2.144.0/20 has its route object there under MAINT-AS49981. The IRR macro is AS-WORLDSTREAM, the aut-num sends peering questions to as49981.peeringdb.com, and the PeeringDB note is the company's own statement that it has implemented the norms for Routing Security, MANRS.
Two things have gone stale. The looking glass PeeringDB advertises, lg.worldstream.nl, no longer resolves at all; what is actually up is the status page at noc.worldstream.com, so checking how a prefix is announced from outside needs a third-party route collector. And the capacity figures disagree with each other: worldstream.com advertises a 10Tbit-per-second-plus network while the PeeringDB record it directs peers to still reports 1 to 5 Tbps. There is no geofeed on any object checked - 109.236.80.0/20, 109.236.85.0/24, 175.110.112.0/20 - and RDAP returns no geofeed link, so country NL on the inetnum is the entire location statement the operator makes.
Finding the tenant behind a WorldStream address
The registry will not name one. Every inetnum checked is netname WORLDSTREAM, country NL, status ASSIGNED PA, maintained by MNT-WORLDSTREAM, with descriptions that read as internal inventory labels - WorldStream IPv4.28 on 109.236.85.0/24 - and remarks such as INFRA-AW rather than a customer name. Unlike hosters that create a per-customer object for each assignment, WorldStream registers the whole estate to itself, so a whois lookup on any address in the announced space attributes it to WorldStream and stops there.
That makes reverse DNS the only public discriminator. The default hosted-by-worldstream.net name, with the address hyphenated in front of it, marks an address whose reverse zone the customer has not taken over; a custom hostname on one of these blocks is the tenant naming their own machine, and is normally the strongest hint available about who is there. The formal route is abuse: WorldStream's policy positions the company as a mere conduit that cannot select or amend content on unmanaged infrastructure, asks reports to include log files with exact timestamps, addresses and static URLs, and states that notifications are handled within two working days - it says nothing about disclosing which customer. Inbound connections are ordinary here by construction, because these are servers; an address on this network accepting connections is the expected behaviour, not a symptom.
Related tools
Frequently asked questions
What address space does WorldStream announce?
The largest blocks are above. They are registered in two different registry databases but all point at the same Naaldwijk company: RIPE allocations under MNT-WORLDSTREAM such as 109.236.80.0/20 and 175.110.112.0/20, and a LACNIC object for 190.2.144.0/20 reallocated to WorldStream B.V. in November 2017.
What does hosted-by-worldstream.net mean?
It is WorldStream's default reverse-DNS name, built from the address with the dots replaced by hyphens. It tells you the address is a WorldStream-hosted machine whose reverse zone the customer has not customised. It does not identify the customer or the service running there.
Can I find out which customer is on a WorldStream IP?
Not from public records. Every inetnum in the announced space is registered to WorldStream itself under the netname WORLDSTREAM with no per-customer sub-allocation, and the abuse policy commits to handling notifications within two working days without undertaking to name the tenant. A custom reverse hostname is often the only clue.
Why do some WorldStream blocks look Latin American or Asian?
Because the address space came from other registries. 190.2.144.0/20 is a LACNIC record reallocated to WorldStream B.V., and 175.110.112.0/20 sits inside 175/8, which IANA allocated to APNIC, though the object itself is now a RIPE allocation. Both are registered to the Netherlands, so a database that guesses a region from the block gets them wrong.
My connection shows a WorldStream address - what does that indicate?
An address on AS49981 is a rented machine in a Dutch data centre, and the reverse name usually says so outright: 109.236.85.20 is 109-236-85-20.hosted-by-worldstream.net, 190.2.144.20 is 190-2-144-20.hosted-by-worldstream.net. In a privacy test this is the datacentre answer rather than the residential one, and nothing in the public record narrows it further, because a VPN exit, a scraper, a game server and a mail relay all present identically from outside. Two of the blocks deserve a separate flag. 190.2.144.0/20 is a LACNIC object, reallocated to WorldStream B.V. on 27 November 2017, while 175.110.112.0/20 comes out of 175/8, which IANA allocated to APNIC, yet its object is a RIPE allocation named NL-WORLDSTREAM-20200520 with country NL. A geolocation service that infers a region from which /8 a block came out of will place those machines in Latin America or Asia, while both records say the Netherlands.