I would guess that certain IP addresses are being checked for. In all likelyhood the tests for 80 and 40 are enough to distinguish the required addresses from the others. Without knowing the addressing scheme used on the system in question it is not possible to determine anything more detailed.