cancel
Showing results for 
Search instead for 
Did you mean: 

Should this be of concern?

N/A

Should this be of concern?

As I was browsing, I discovered this page, which worryingly (?) appear to have an awful lot of plus.net IP addresses listed on it.

Could this bear any link to the recent traffic problems?

http://www.senderbase.org/search?page=senders
6 REPLIES
Community Veteran
Posts: 1,653
Registered: 13-06-2007

Should this be of concern?

The page you are looking at is related to email being sent from pns email servers, a lot of that will be automated mail from the cgi servers!

It doesn't relate to normal traffic!
N/A

Should this be of concern?

Quote
a domain with a magnitude of 5 would have estimated volume of 100,000/day

There's at least 14 on the first page that exceed 4.0 which is 10,000/day and a couple doing 100,000 day. Is 10,000 per day really going to be cgi or is it going to be those users who've picked up spamming viruses?

Perhaps these addresses are the reason the email servers keep dying.
N/A

Should this be of concern?

That's what I was thinking.

This system is worldwide, I wouldn't expect a relatively 'small' ISP like Plusnet to be providing so much email service to the world.

Maybe someone from Plus could have a look and clear it up.

Thanks
N/A

Should this be of concern?

Well, no communication back from Plusnet about this matter, but I did raise it with jamesbailey on MSN a couple of nights ago.

It does appear that the amount of entires for Plusnet on the main list has gone from around 6 to just 1.

Any feedback from Plusnet would be good, if not as an explanation, then just to satisfy my curiosity.

Thanks.
James
Grafter
Posts: 21,036
Registered: 04-04-2007

Should this be of concern?

Sorry, meant to reply to this yesterday. My answer back from networks:

The four servers listed there are all the mx-last servers. These machines can ONLY send mail to the mxcore platform, they cannot send mail externally - meaning that all that mail is mail to our customers.

The reason that they have quite a lot of spam is that they are the last preference mx records and spammers commonly send mail direct to them (any last pref mx, not just ours) under the impression that they have less strict spam filtering.

In our case, however, the mxlast servers just pass the mail onto the mxcores - which then run it past blacklists etc and spam and virus filtering - so most of the mail then probably gets deleted.

Unless you can find out how the figures are generated, there is nothing we can do about it.

Josh
N/A

Should this be of concern?

Quote
IronPort SenderBase® Network is the industry’s first, largest and most accurate global email traffic monitoring network-tracking more than 25% of the world’s email traffic, from 75,000 participating organizations.

That suggests the emails are being picked up by external sources (unless you are one of the participating organisations and somehow don't know about it), as in, not being sent internally.
I suppose they could be measuring how many emails are being sent to these IPs, but it's still scary to think that some people are receiving 10,000 a day.

If you check here you'll see that there's lots of PN addresses with more than 4.0 (10,000/day), with most of the addresses implying they are actual customers rather than mx servers.