AS52129 — PROOFPOINT-ASN-EU

Network type: hosting

AS52129 announces 21 IPv4 prefixes covering 11,520 addresses and 1 IPv6 prefixes.

About this network

PROOFPOINT-ASN-EU is Proofpoint, Inc.'s hosted email-security platform. Most of its addresses are dedicated mail gateways that relay inbound and outbound email for Proofpoint's customers. It is a hosting network for other organisations' mail, not Proofpoint's own office network.

What it's used for

• Customer mail relays. Nearly every sampled address has a reverse DNS name like mx07-00114401.pphosted.com or mx1a-00a85d01.pphosted.com. The mxNN part is the gateway cluster and the hex part identifies the customer. When an organisation's MX record points at pphosted.com, its mail lands here first for filtering.
• Platform plumbing. The rest of the space is Proofpoint's own infrastructure: core routers (cr4001, cr5001, cr8001.proofpoint.com), EU storage and dispatch (storage-eu.ppe-hosted.com, dispatchb-eu1.ppe-hosted.com) and telemetry (trafficstats-ams, trafficstats-fra.proofpoint.com).
• Where. Address space is registered in the US (ARIN PROOF, PROOFPOINT-NET-NORTH-AMERICA), Australia (PROOFPOINT-AU) and Europe (RIPE UK-PROOFPOINT-20151223, NL-PROOFPOINT, PROOFPOINT-DE, PROOFPOINT-GB, pfptnl). Despite the "EU" in the AS name, it serves all three regions.

What traffic from it means

• A connection from this AS is almost certainly an automated mail server relaying email for a Proofpoint customer. It is not a person browsing, and it is not a VPN or proxy exit.
• Mail from these IPs was sent on behalf of a Proofpoint customer, not by Proofpoint. The customer ID in the PTR name tells you which tenant gateway handled it.

Notable

• 46 IPv4 prefixes (21 blocks once merged, 11,520 addresses) and two IPv6 /44s (2a0a:2b00::/44, 2a0a:2b00:10::/44).
• It has only upstream providers (Arelion AS1299, Cogent AS174, Hurricane Electric AS6939, Sify AS9583, Zayo AS21859) and no customer networks behind it, so it is an end network, not transit.
• Two blocks come from Proofpoint's 2019 purchase of Meta Networks (Nsof Networks). ARIN still lists 208.56.0.0/18 under "Meta Networks Inc", and RIPE lists 185.169.148.0/24 as IL-NSOFNETWORKS-20160923. Both now carry pphosted.com mail gateways.
• One staff remote-access host (ravpn-ams.proofpoint.com) is on the network. It is corporate remote access, not a consumer VPN service.
• Proofpoint runs other networks as well: AS13916, AS22843 and AS26211.
• Thoma Bravo took Proofpoint private in 2021.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy.

Announced prefixes

• 66.159.224.0/23
• 66.159.232.0/22
• 66.159.236.0/23
• 66.159.243.0/24
• 66.159.244.0/22
• 66.159.252.0/22
• 91.207.212.0/23
• 91.209.104.0/24
• 143.55.144.0/22
• 143.55.148.0/23
• 143.55.150.0/24
• 185.132.180.0/22
• 185.169.148.0/24
• 185.183.28.0/22
• 205.220.184.0/23
• 208.56.0.0/24
• 208.56.4.0/23
• 208.56.6.0/24
• 208.56.17.0/24
• 208.84.64.0/24
• 208.86.200.0/24
• 2a0a:2b00::/43

Upstream networks

• AS6939 Hurricane Electric LLC
• AS21859 Zenlayer Inc
• AS1299 Arelion Sweden AB
• AS174 Cogent Communications, LLC
• AS9583 Sify Limited

Adjacent networks

• AS6939 Hurricane Electric LLC
• AS21859 Zenlayer Inc
• AS1299 Arelion Sweden AB
• AS174 Cogent Communications, LLC
• AS9583 Sify Limited

Routing security

• RPKI: 48 valid, 0 invalid and 0 not-found announcements; 37 ROAs.
• ASPA: none published.
• IRR: 75% of announcements registered; 47 route objects.
• Listed in as-sets: AS-C3, AS-EQUINIX-AM, AS-EQUINIX-FR, AS-EQUINIX-ME, AS-EQUINIX-SY, AS-HURRICANE, AS-HURRICANEV6, AS-INCAPSULA, AS-INCAPSULA, AS-KDDCUSTOMER2, AS-PACKET, AS-SUPERLOOP-CUST, AS-TRANSROUTE-SPEC, AS-ZENLAYER, AS-ZENLAYER-DXB-OMANTEL, AS1221:AS-CUSTOMERS, AS1299:AS-TWELVE99-EU-V4, AS1299:AS-TWELVE99-EU-V6, AS19551:AS-IMPERVA, AS3491:AS-CUSTOMERS-EU, AS52129:AS-SET, AS58453:AS-ASIAASCUST, AS58453:AS-ASIAASCUST, AS9583:AS-SIFY.