asn.dev

Autonomous system

AS49981 WORLDSTREAM

Hosting RIPE

IPv4 addresses 73.22K 106 prefixes
IPv6 prefixes 18 counted as prefixes, not addresses
Countries 1 mostly NL
Exchanges 10 recorded by PCH
Upstreams 42 49 downstream
Flagged prefixes 0 none

Summary

WorldStream

Netherlands · AI-generated

hosting isp netherlands business

WORLDSTREAM is operated by WorldStream B.V.

What it's used for

  • The address space carries hosted services and customer infrastructure, evidenced by reverse DNS entries such as customer.worldstream.nl and hosted-by-worldstream.net.
  • With 75,008 IPv4 addresses announced across 113 prefixes and 219 observed neighbours, the network functions as a hosting and business ISP provider rather than a pure transit carrier.
  • Traffic from this AS consists primarily of web hosting, API endpoints, and business customer connectivity for European and Latin American clients.

Notable

  • Registrants are consistent with the announcer, with most prefixes registered to WorldStream B.V. or WORLDSTREAM DBM, while the largest block 190.2.128.0/19 is registered to WORLDSTREAM LATAM B.V..
  • The inventory includes a distinct block 45.150.156.0/22 registered to Cornelis Reinier Monshouwer, trading as Monshouwer Internet Diensten, indicating leased or acquired space within the AS.
  • The address inventory is finely subdivided into numerous /22 and /21 blocks, reflecting a segmented corporate and customer estate.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.

Interconnection

Peering at a glance

Full topology · Graph

Internet exchanges

Recorded at 10 exchanges in 3 countries, largest first.

ExchangeLocationTheir address
DE-CIX FrankfurtFrankfurt, Germany80.81.195.203
AMS-IX AmsterdamAmsterdam, Netherlands80.249.210.37
Neutral Internet ExchangeAmsterdam, Netherlands193.239.116.249
The Frys Internet ExchangeFrysian, Netherlands2001:7f8:10f::c33d:335
Speed Internet ExchangeDronten, Netherlands185.1.222.31
InterIX Internet ExchangeAmsterdam, Netherlands2001:7f8:134::3a
Peering.czPrague, Czech Republic185.0.20.103
ERA-IX AmsterdamAmsterdam, Netherlands185.1.240.193

All 10 exchanges →

Transit providers

42 upstream, 49 downstream and 133 adjacent networks observed; most-used upstreams first.

ASNetworkPaths seen
AS1299Arelion Sweden AB1,173
AS174Cogent Communications, LLC850
AS6939Hurricane Electric LLC821
AS34549meerfarbig GmbH & Co. KG483
AS6830Liberty Global Europe Holding B.V.439
AS3320Deutsche Telekom AG352
AS3356Level 3 Parent, LLC321
AS50304Blix Solutions AS262

All 42 upstreams →

Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-11, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.

Address space

Summary

Shape and geography

IPv4 106 prefixes · 73.22K addresses IPv6 18 prefixes

CountryNamePrefixes
NLNetherlands124

Registry

Allocation record

RIPE · via Atlas (registry + RDAP)
Registry
RIPE
Handle
AS49981
Registry name
WorldStream
Registrant
MNT-WORLDSTREAM
Abuse contact
abuse@worldstream.nl
Registered
2009-12-01
Last changed
2025-05-07
Allocation
allocated

Routing security

RPKI and IRR

Full detail
RPKI
98% valid · 130 valid, 3 with no ROA
ROAs
309 authorising AS49981
ASPA
no ASPA record
IRR
98% registered · 131 of 133 announcements
Route objects
352 naming AS49981

Reputation

Classification and threat

Hosting Datacenter or cloud provider. Addresses are servers, not people.

Spamhaus DROP

Not on ASN-DROP The network as a whole is not listed.

No DROP prefixes None of its announced space is on the DROP prefix list.

Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 432 networks and 1,768 prefixes, as published 2026-10-12. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.

FBI IC3

11 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.

PrefixAdvisoryPublished
175.110.121.107Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure2026-07-22
175.110.121.39Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure2026-07-22
175.110.121.41Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure2026-07-22
175.110.121.42Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure2026-07-22
185.184.192.108"First VPN Service" Used by Ransomware Actors to Compromise Systems2026-05-21
190.2.142.25"First VPN Service" Used by Ransomware Actors to Compromise Systems2026-05-21
190.2.142.28"First VPN Service" Used by Ransomware Actors to Compromise Systems2026-05-21
217.23.1.110"First VPN Service" Used by Ransomware Actors to Compromise Systems2026-05-21
62.112.8.202"First VPN Service" Used by Ransomware Actors to Compromise Systems2026-05-21
93.190.142.7"First VPN Service" Used by Ransomware Actors to Compromise Systems2026-05-21

Showing the first 10 of 11.

IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.

Elsewhere

Cross-check