asn.dev

Autonomous system

AS209605 HOSTBALTIC

Hosting Spamhaus ASN-DROP RIPE

IPv4 addresses 2.30K 6 prefixes
IPv6 prefixes 0 counted as prefixes, not addresses
Countries 1 mostly LT
Exchanges 1 recorded by PCH
Upstreams 4 2 downstream
Flagged prefixes 0 none

Summary

UAB Host Baltic

Lithuania · AI-generated

hosting dedicated vps

hostbaltic is UAB Host Baltic, a Lithuanian hosting provider selling dedicated servers and VPS out of Kaunas, trading as both Host Baltic and ServerOffer.

What it's used for

Server hosting. RIS observes 9 IPv4 prefixes totalling 2,304 addresses and no IPv6, concentrated in 141.98.8.0/22 with additional blocks at 193.31.6.0/24, 91.224.92.0/24, 185.169.4.0/24, 185.36.81.0/24 and 185.166.92.0/24.

Transit comes from AS133398, AS6939 (Hurricane Electric) and AS9002 (RETN). Three customer ASNs sit behind it: AS209101, AS209425 and AS213790 — that last one being Btcloud.ro, another hosting reseller.

Notable

  • The operator hosts itself, which is a useful identity confirmation: hostbaltic.com resolves to 141.98.8.30, inside its own 141.98.8.0/24.
  • Reverse DNS on the two prefixes that answer is unambiguous server naming under the second brand — sr-71.serveroffer.net, host-141-98-8-200.serveroffer.net, GW-DEDI.KUN.LT.serveroffer.lt (KUN = Kaunas) and srv-141-98-11-{5,100,200}.serveroffer.net. The remaining seven prefixes have no rDNS at all. Nothing anywhere resembles broadband, dyn or pppoe naming.
  • Listed in Spamhaus ASN-DROP under the domain serveroffer.lt, and 141.98.11.0/24 is in Spamhaus DROP as SBL620221.

Interesting

  • The ASN dates to 2019-01-10 and has a PeeringDB record, both of which set it apart from the shell-shaped networks it often gets reported alongside. This is a small but real hosting business.
  • It appears in the upstream Munzy/Blackbox hosting.csv as 209605,"HOSTBALTIC - UAB Host Baltic", so it was already classified as hosting before any curation on our side.
  • The serveroffer.lt domain that Spamhaus records does not currently serve a site over HTTP or HTTPS, even though the rDNS is still built on it. The hostbaltic.com side answers but returns a near-empty page.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.

Interconnection

Peering at a glance

Full topology · Graph

Internet exchanges

Recorded at 1 exchange in 1 country, largest first.

ExchangeLocationTheir address
Baltic Internet ExchangeVilnius, Lithuania77.241.206.86

Transit providers

4 upstream, 2 downstream and 6 adjacent networks observed; most-used upstreams first.

ASNetworkPaths seen
AS133398Tele Asia Limited400
AS9002RETN Limited160
AS3303Swisscom (Schweiz) AG10
AS6939Hurricane Electric LLC8

Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-13, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.

Address space

Summary

Shape and geography

IPv4 6 prefixes · 2.30K addresses IPv6 0 prefixes

CountryNamePrefixes
LTLithuania6

Registry

Allocation record

RIPE · via Atlas (registry + RDAP)
Registry
RIPE
Handle
AS209605
Registry name
hostbaltic
Registrant
mnt-lt-hostbaltic-1
Abuse contact
admin@serveroffer.lt
Registered
2019-01-10
Last changed
2019-01-10
Allocation
allocated

Routing security

RPKI and IRR

Full detail
RPKI
44% valid · 4 valid, 5 with no ROA
ROAs
4 authorising AS209605
ASPA
no ASPA record
IRR
100% registered · 9 of 9 announcements
Route objects
16 naming AS209605

Reputation

Classification and threat

Hosting Datacenter or cloud provider. Addresses are servers, not people.

Spamhaus DROP

On Spamhaus ASN-DROP Spamhaus lists this entire network (associated domain serveroffer.lt) as controlled by, or hijacked for, cybercrime. Many operators null-route everything it originates.

8 DROP matches Announced space overlapping the DROP prefix list.

AnnouncedDROP entryRecord
91.224.92.0/2491.224.92.0/24SBL642214
141.98.8.0/22141.98.8.0/24SBL642215
141.98.8.0/22141.98.9.0/24SBL692929
141.98.8.0/22141.98.10.0/24SBL694569
141.98.8.0/22141.98.11.0/24SBL620221
185.36.81.0/24185.36.81.0/24SBL641912
185.166.92.0/24185.166.92.0/24SBL697030
185.169.4.0/24185.169.4.0/24SBL642216

Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 442 networks and 1,773 prefixes, as published 2026-10-13. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.

FBI IC3

No IC3 indicators Nothing from the FBI IC3 feed.

IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.

Elsewhere

Cross-check