Sh4mefulIP Address: 104.47.55.169 ⚠ IP Confounder
Exchange Online Protection (EOP) is a cloud-based email filtering service included with all Microsoft 365 subscriptions to protect against spam, malware, and phishing attacks. It automatically secures mailboxes by filtering incoming and outgoing messages in real-time using anti-spam, anti-malware, and content filters. During periods of active campaign activity, these can largely be ignored (esp. when recipients are on Exchange). However, forged emails have been observed from Microsoft infrastructure that have this signature too.
Differentiating between Office 365, including email protection services, and Azure (public cloud) when diagnosing incidents is challenging because they utilize shared Microsoft-owned IP ranges. Most of this is probably O365/Outlook or Defender protection breaking DKIM and SPF authentication. Disambiguation is a work-in-progress.
This page shows DMARC authentication failure data for this IP address. Learn more about this data.
Geolocation Information
- Country:
- US United States
- Region:
- Virginia
- City:
- Boydton
- Coordinates:
- 36.6694, -78.3877
WHOIS Information
- Network Name:
- MSFT
- CIDR:
104.40.0.0/13- Owner:
- Microsoft Corporation
- Org ID:
MSFT- Address:
- One Microsoft Way, Redmond, WA 98052
- Reverse DNS:
-
mail-bn8nam12lp2169.outbound.protection.outlook.com
Last updated: 2/5/2026
Analysis
This IP was first observed on March 13, 2024 and most recently on August 1, 2025. It has been associated with 31 failed authentication events affecting 66 messages, representing significant volume. The IP belongs to MSFT (Microsoft Corporation), a network with activity associated with United States. 8 other IPs in the same /24 subnet (104.47.55.*) also appear in this dataset.
Network Topology
Failures Detected from this IP
Showing 1-31 of 31 failures, affecting 66 messages| Date ▼ | Messages |
|---|---|
| 8/1/2025 | 1 |
| 7/18/2025 | 1 |
| 7/17/2025 | 1 |
| 6/28/2025 | 1 |
| 6/26/2025 | 1 |
| 6/4/2025 | 1 |
| 5/14/2025 | 1 |
| 5/9/2025 | 1 |
| 5/2/2025 | 2 |
| 3/28/2025 | 2 |
| 3/19/2025 | 1 |
| 3/12/2025 | 1 |
| 2/26/2025 | 4 |
| 2/14/2025 | 5 |
| 1/17/2025 | 1 |
| 12/18/2024 | 3 |
| 12/11/2024 | 3 |
| 12/10/2024 | 1 |
| 12/5/2024 | 2 |
| 12/4/2024 | 2 |
| 11/21/2024 | 2 |
| 11/20/2024 | 3 |
| 11/12/2024 | 1 |
| 10/30/2024 | 1 |
| 10/23/2024 | 6 |
| 9/27/2024 | 1 |
| 9/13/2024 | 4 |
| 5/31/2024 | 2 |
| 5/10/2024 | 1 |
| 4/17/2024 | 4 |
| 3/13/2024 | 6 |
External Reputation Lookups
Look up this IP in external threat intelligence and reputation databases (opens in new tab):
Nearby IPs
Other IPs in the 104.47.55.0/24 range observed failing DMARC:
104.47.55.46 (61 failures), 104.47.55.174 (60 failures), 104.47.55.49 (59 failures), 104.47.55.47 (58 failures), 104.47.55.172 (52 failures), 104.47.55.40 (51 failures), 104.47.55.41 (50 failures), 104.47.55.168 (49 failures)