$ host smtp01.bis.eu.blackberry.com
smtp01.bis.eu.blackberry.com has address 67.223.92.48
smtp01.bis.eu.blackberry.com has address 216.9.253.48

$ host 67.223.92.48
48.92.223.67.in-addr.arpa domain name pointer bda-67-223-92-48.bise.na.blackberry.com.
$ host 216.9.253.48
48.253.9.216.in-addr.arpa domain name pointer smtp01.bis.eu.blackberry.com.

These appear to be within 216.9.240.0/20 and 67.223.64.0/19 so if someone walked the cidr range a lot more would be known.

The “na” part of the domain name stands for “North America”. Over here, in the UK, our BIS servers are in the format:
smtp01.bis.eu.blackberry.com

This begs the question, “How many regions does RIM define, across the globe?”

I imagine there are different servers for Asia, Africa, Australasia, and South America, too.