Sh4mefulDMARC Spoof Detection, Failed Authentications
About this Project
▶Sh4meful tracks IP addresses caught sending unauthorized email, detected through DMARC report analysis across millions of authentication records.
Every entry here is an IP address that failed both SPF and DKIM authentication checks for domains I monitor. In most cases, that means someone (or something) used the domain name without permission; a signature pattern of email spoofing, phishing, spam, and other abusive mail activity.
The dataset is drawn from DMARC aggregate reports and represents a fraction of a larger corpus spanning millions of messages. Each record shows what failed and where: the source IP, its network, its geography, and limited metadata from the authentication event. Determining intent, whether a failure is hostile or incidental, requires context beyond what DMARC provides, but the patterns speak clearly enough at volume.
Not every failure is malicious. Some legitimate services (email security gateways, spam filters, phishing analysis platforms) break authentication as a side effect of message inspection or forwarding. I track these confounders separately and hide them by default, though they remain available for review. Much of that traffic is benign infrastructure noise. Some isn't.
Elements of this dataset and supporting models will eventually be open-sourced on GitHub. (More)
55,367
7,319
924
93,248
Failures
Showing 1-10 of 55,367 failures, affecting 93,248 messages| Date ▼ | Source IP | Country | City | Network | Messages |
|---|---|---|---|---|---|
| 4/15/2026 | US United States | Fremont | 1 | ||
| 4/15/2026 | DE Germany | 1 | |||
| 4/15/2026 | ES Spain | Barcelona | 1 | ||
| 4/15/2026 | KZ Kazakhstan | Karaganda | 1 | ||
| 4/15/2026 | RU Russia | Ivanovo | 1 | ||
| 4/15/2026 | JM Jamaica | 1 | |||
| 4/15/2026 | RU Russia | 1 | |||
| 4/15/2026 | RU Russia | Ufa | 1 | ||
| 4/15/2026 | BR Brazil | Sinop | 1 | ||
| 4/14/2026 | US United States | North Charleston | 1 |
DMARC Activity
Browse by Country
Most Active Networks by Spoof Volume (30 days)
Top networks by failed message volume over the last 30 days.
AT-88-Z
UK-MICROSOFT-20060601
MSFT
AMAZO-4
AMAZON-2011L
UZTELECOM
HINET-NET
VIETTEL-VN
spaceshipnetworks
RIPE
KORNET-KR
GPON_FTTH_SERVICES
IP2000-ADSL-BAS
Claro NXT Telecomunicacoes Ltda
Most Active IPs by Spoof Volume (30 days)
Top IP addresses by failed message volume over the last 30 days.
IP Intelligence Report for 35.174.145.124
IP Intelligence Report for 2a01:111:f403:c107::3
IP Intelligence Report for 2a01:111:f403:c10c::1
IP Intelligence Report for 2a01:111:f403:c000::1
IP Intelligence Report for 54.227.64.76
IP Intelligence Report for 2a01:111:f403:c10d::1
IP Intelligence Report for 2a01:111:f403:c112::5
IP Intelligence Report for 2a01:111:f403:c110::3
IP Intelligence Report for 2a01:111:f403:c001::2
IP Intelligence Report for 100.21.157.149
IP Intelligence Report for 2a01:111:f403:c111::9
IP Intelligence Report for 34.210.15.192
IP Intelligence Report for 3.132.222.232
IP Intelligence Report for 3.132.108.44
IP Intelligence Report for 2a01:111:f403:c112::7
IP Intelligence Report for 2a01:111:f403:c105::7
IP Intelligence Report for 209.85.220.69
IP Intelligence Report for 3.231.237.226
IP Intelligence Report for 2a01:111:f403:c107::1
IP Intelligence Report for 52.212.19.177
The geography of DMARC failures is shifting, and the data says it's not random
7,528 failed DMARC authentications across 115 countries over 16 months. The source countries are changing in ways that suggest coordinated infrastructure migration, not organic drift.
Read more → All posts →