What is Inbound Abuse Monitor?
Inbound Abuse Monitor identifies the most problematic or "top offending" IPs on a daily basis and displays pertinent information about those IPs in a simple and clear user interface. This reduces the need to search through thousands of IPs and allows you to quickly obtain the information necessary to make informed decisions around filtering and blocking.
What is Global View?
Global View is an extension of Inbound Abuse Monitor that allows you to see how your “top offending” IPs are being perceived at other Mailbox Providers. Global View provides global metrics for these additional Mailbox Providers. In the Inbound Abuse Monitor user interface, you see the IP complaint count, volume, and rate for your metrics and the global metrics. The global columns represent the total across all 20+ Mailbox Providers that are a part of the Universal Feedback Loop (UFBL).
How do we choose 'Top Offending' IPs?
Return Path goes through all the Inbound IPs that contribute to spam for each Mailbox Provider and finds those with the highest complaint count (“this is spam” votes). The IPs are then sorted by highest complaint rate. This allows for visibility into the IPs that have a high complaint rate (high complaint/volume ratio) without including IPs with low volumes.
Why Top 30 IPs?
Data analysis finds that complaint rates start to taper off at/around the top 30 IP mark. Complaint rates usually drop significantly below 1% and start to become consistently low along with low complaint counts and volume.
Why don't I see our Mailbox Provider (MBP) IPs?
Inbound Abuse Monitor only shows inbound IPs (IPs sending mail to your MBP from outside entities) rather than outbound IPs.
How do I access Global View?
On the bottom right hand corner of the Inbound Abuse Monitor graph with a toggle that says ‘Global View’. When you toggle that button, you see your Global View metrics.
Why don't I see the Global View toggle?
Global view is a unique view that only Return Path can provide. It’s beyond the standard benefit of the Universal Feedback Loop (UFBL). We never charge for these features but we do request a volume feed to go along with a complaint feed. If you aren’t sure if your MBP provides Return Path a volume feed, please feel free to reach out to email@example.com.
Why can't I see any data for volume and complaint rate?
In the event that volume and complaint rate data is not populating in the dashboard, it is likely that your MBP does not provide Return Path a volume feed (i.e. log data showing inbound volume to your MBP). In that case, we can not present volume or complaint rate metrics. If you’re interested in learning more about providing a feed for access to this valuable data within Inbound Abuse Monitor, please contact firstname.lastname@example.org.
If your MBP currently provides Return Path with a volume feed, it may be that those metrics have not yet been received by our system. Please check back in an 1-2 hours to see if those metrics have populated. If you do not see those metrics in more than 6 hours, there may be an issue with the feed. Please contact email@example.com
We don't participate in the Universal Feedback Loop (UFBL), can we still have access to Inbound Abuse Monitor and Global View?
If you provide us a complaint feed outside of the UFBL, you can request to have that feed displayed through Inbound Abuse Monitor. Global View is typically reserved for participants of the Universal Feedback Loop (UFBL). We treat these requests on a case by case basis. Please contact firstname.lastname@example.org for more information.
Why do I only see volume and complaint rate data for some IPs and not others?
In the event that volume and complaint rate data is only populating for some IPs it is likely that we have not yet received volume metrics from your MBP that corresponds to that IP (i.e. we have complaint counts, but no volume data). In some cases, we may not receive all volume data from your MBP.
If there is a significant gap in coverage, please contact email@example.com
Why is there more than one organization or subscription for an IP in the subscriptions column?
The subscription column in Inbound Abuse Monitor references subscriptions to the Universal Feedback Loop (UFBL). Sometimes senders create different organizations and subscriptions within the UFBL for their IPs depending on clients, regions, or departments. This is why you may click on an organization and see multiple subscriptions for a single IP. You may also see "no organization." This means there are UFBL subscriptions maintaining this IP but the sender has not provided the organization name.
How is the tool populating the domain?
We perform an rDNS lookup to generate the domain you see under the IP. Due to the dynamic nature of DNS, you may see the domain change when the data is updated.
Why can't I see all IPs when I search in the tool? Why just 'Top Offending?'
Since thousands of IPs contribute to spam at your MBP everyday, a UI search through that many IPs over a 30 day span is implausible.