Autonomous system
AS49981 WORLDSTREAM
Hosting RIPE Network Services
Summary
WorldStream
hosting isp netherlands business
WORLDSTREAM is operated by WorldStream B.V.
What it's used for
- The address space carries hosted services and customer infrastructure, evidenced by reverse DNS entries such as
customer.worldstream.nlandhosted-by-worldstream.net. - With 75,008 IPv4 addresses announced across 113 prefixes and 219 observed neighbours, the network functions as a hosting and business ISP provider rather than a pure transit carrier.
- Traffic from this AS consists primarily of web hosting, API endpoints, and business customer connectivity for European and Latin American clients.
Notable
- Registrants are consistent with the announcer, with most prefixes registered to
WorldStream B.V.orWORLDSTREAM DBM, while the largest block190.2.128.0/19is registered toWORLDSTREAM LATAM B.V.. - The inventory includes a distinct block
45.150.156.0/22registered toCornelis Reinier Monshouwer, trading as Monshouwer Internet Diensten, indicating leased or acquired space within the AS. - The address inventory is finely subdivided into numerous /22 and /21 blocks, reflecting a segmented corporate and customer estate.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 10 exchanges in 3 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| DE-CIX Frankfurt | Frankfurt, Germany | 80.81.195.203 |
| AMS-IX Amsterdam | Amsterdam, Netherlands | 80.249.210.37 |
| Neutral Internet Exchange | Amsterdam, Netherlands | 193.239.116.249 |
| The Frys Internet Exchange | Frysian, Netherlands | 2001:7f8:10f::c33d:335 |
| Speed Internet Exchange | Dronten, Netherlands | 185.1.222.31 |
| InterIX Internet Exchange | Amsterdam, Netherlands | 2001:7f8:134::3a |
| Peering.cz | Prague, Czech Republic | 185.0.20.103 |
| ERA-IX Amsterdam | Amsterdam, Netherlands | 185.1.240.193 |
Transit providers
39 upstream, 48 downstream and 130 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-13, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 106 prefixes · 73.22K addresses IPv6 18 prefixes
| Country | Name | Prefixes |
|---|---|---|
| NL | Netherlands | 124 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS49981- Registry name
- WorldStream
- Registrant
- MNT-WORLDSTREAM
- Abuse contact
- abuse@worldstream.nl
- Registered
- 2009-12-01
- Last changed
- 2025-05-07
- Allocation
- allocated
Declared
PeeringDB profile
- Name
- Worldstream BV
- Also known as
- Worldstream Network
- Network type
- Network Services
- Scope
- Europe
- Traffic ratio
- Mostly Outbound
- Peering policy
- Open
- IRR as-set
AS-WORLDSTREAM- Present at
- 9 exchanges
- Facilities
- 10 facilities
- Website
- https://www.worldstream.com
PeeringDB records are maintained by the network operator and are not independently verified. Treat them as a statement of intent rather than of fact. For the observed and recorded view, see peering, which lists the exchanges Packet Clearing House has a port on file for.
Routing security
RPKI and IRR
- RPKI
- 98% valid · 130 valid, 3 with no ROA
- ROAs
- 309 authorising AS49981
- ASPA
- no ASPA record
- IRR
- 98% registered · 131 of 133 announcements
- Route objects
- 352 naming AS49981
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 436 networks and 1,771 prefixes, as published 2026-10-13. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
11 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
175.110.121.107 | Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure | 2026-07-22 |
175.110.121.39 | Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure | 2026-07-22 |
175.110.121.41 | Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure | 2026-07-22 |
175.110.121.42 | Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure | 2026-07-22 |
185.184.192.108 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
190.2.142.25 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
190.2.142.28 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
217.23.1.110 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
62.112.8.202 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
93.190.142.7 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
Showing the first 10 of 11.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere