asn.dev

Autonomous system

AS52129 PROOFPOINT-ASN-EU

Hosting RIPE

IPv4 addresses 11.52K 21 prefixes
IPv6 prefixes 1 counted as prefixes, not addresses
Countries 1 mostly US
Exchanges 0 recorded by PCH
Upstreams 5 0 downstream
Flagged prefixes 0 none

Summary

Proofpoint

Global · AI-generated

hosting email proofpoint security

PROOFPOINT-ASN-EU is Proofpoint, Inc.'s hosted email-security platform. Most of its addresses are dedicated mail gateways that relay inbound and outbound email for Proofpoint's customers. It is a hosting network for other organisations' mail, not Proofpoint's own office network.

What it's used for

  • Customer mail relays. Nearly every sampled address has a reverse DNS name like mx07-00114401.pphosted.com or mx1a-00a85d01.pphosted.com. The mxNN part is the gateway cluster and the hex part identifies the customer. When an organisation's MX record points at pphosted.com, its mail lands here first for filtering.
  • Platform plumbing. The rest of the space is Proofpoint's own infrastructure: core routers (cr4001, cr5001, cr8001.proofpoint.com), EU storage and dispatch (storage-eu.ppe-hosted.com, dispatchb-eu1.ppe-hosted.com) and telemetry (trafficstats-ams, trafficstats-fra.proofpoint.com).
  • Where. Address space is registered in the US (ARIN PROOF, PROOFPOINT-NET-NORTH-AMERICA), Australia (PROOFPOINT-AU) and Europe (RIPE UK-PROOFPOINT-20151223, NL-PROOFPOINT, PROOFPOINT-DE, PROOFPOINT-GB, pfptnl). Despite the "EU" in the AS name, it serves all three regions.

What traffic from it means

  • A connection from this AS is almost certainly an automated mail server relaying email for a Proofpoint customer. It is not a person browsing, and it is not a VPN or proxy exit.
  • Mail from these IPs was sent on behalf of a Proofpoint customer, not by Proofpoint. The customer ID in the PTR name tells you which tenant gateway handled it.

Notable

  • 46 IPv4 prefixes (21 blocks once merged, 11,520 addresses) and two IPv6 /44s (2a0a:2b00::/44, 2a0a:2b00:10::/44).
  • It has only upstream providers (Arelion AS1299, Cogent AS174, Hurricane Electric AS6939, Sify AS9583, Zayo AS21859) and no customer networks behind it, so it is an end network, not transit.
  • Two blocks come from Proofpoint's 2019 purchase of Meta Networks (Nsof Networks). ARIN still lists 208.56.0.0/18 under "Meta Networks Inc", and RIPE lists 185.169.148.0/24 as IL-NSOFNETWORKS-20160923. Both now carry pphosted.com mail gateways.
  • One staff remote-access host (ravpn-ams.proofpoint.com) is on the network. It is corporate remote access, not a consumer VPN service.
  • Proofpoint runs other networks as well: AS13916, AS22843 and AS26211.
  • Thoma Bravo took Proofpoint private in 2021.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.

Interconnection

Peering at a glance

Full topology · Graph

Internet exchanges

No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.

Transit providers

5 upstream, 0 downstream and 8 adjacent networks observed; most-used upstreams first.

ASNetworkPaths seen
AS6939Hurricane Electric LLC1,590
AS21859Zenlayer Inc597
AS1299Arelion Sweden AB441
AS174Cogent Communications, LLC252
AS9583Sify Limited119

Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-11, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.

Address space

Summary

Shape and geography

IPv4 21 prefixes · 11.52K addresses IPv6 1 prefixes

CountryNamePrefixes
USUnited States of America22

Registry

Allocation record

RIPE · via Atlas (registry + RDAP)
Registry
RIPE
Handle
AS52129
Registry name
PROOFPOINT-ASN-EU
Registrant
Proofpoint, Inc.
Abuse contact
abuse@proofpoint.com
Registered
2011-01-05
Last changed
2024-12-17
Allocation
allocated

Routing security

RPKI and IRR

Full detail
RPKI
100% valid · 48 valid, 0 with no ROA
ROAs
37 authorising AS52129
ASPA
no ASPA record
IRR
81% registered · 39 of 48 announcements
Route objects
47 naming AS52129

Reputation

Classification and threat

Hosting Datacenter or cloud provider. Addresses are servers, not people.

Spamhaus DROP

Not on ASN-DROP The network as a whole is not listed.

No DROP prefixes None of its announced space is on the DROP prefix list.

Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 432 networks and 1,768 prefixes, as published 2026-10-12. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.

FBI IC3

No IC3 indicators Nothing from the FBI IC3 feed.

IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.

Elsewhere

Cross-check