R - elists wrote:
>does anyone get legit emails that come from the mailengine1.com
>email marketing servers?
Yes, I've seen a trickle of ham, so did some data mining for you...
The IP ranges I have for them are:
66.59.0.0 - 66.59.31.255
72.19.192.0 - 72.19.255.255
Does anyone have any others?
I found one other hostname:
mailengine3.com
and would infer there would be more, for you RE gurus. :)
The vast majority of what I've seen is spam, however there are
enough "human shields" that you may want to score cautiously,
depending on your environment.
Here's a few of the reasonably legit outfits who use them:
blueman.com
brokerhunter.com
concert-hq.com
dvo.com
email-eventsreg.com
flavorus.com
hotonbroadway.com
quizrocket.com
roddenberry.com
saprankings.com
searchsvc.com
tapulous.com
thecityevents.com
There were also several political spammers, who (as I recall)
were/are bona fide candidates however they list appended party
lists, and did NOT confirm them.
Most of those are "leisure" type sites, so a higher score could
be justifiable in a pure business environment, particularly if
you have a decent quarantine. Personally, I kill them all, with
a hefty margin, but not above the level at which they'd show up
in our FP pipeline (only if they didn't hit any reliable
blocklists while Q'd).
Robert, thanks for asking!
While generating that data, I had an excuse to improve that report.
I also found a "dangling" legacy IP block with a lower spam score,
which should have been deprecated years ago, and now has been. :)
- "Chip"
P.S. The Geek volunteer who hit the "roddenberry" domain
(cheerfully) accused me of killing Star Trek - I vaguely recall
replying with the appropriate McCoy quote. ;)
