Sh4mefulIP Address: 20.245.215.64 ⚠ IP Confounder
This page shows DMARC authentication failure data for this IP address. Learn more about this data.
Geolocation Information
- Country:
- US United States
- Region:
- California
- City:
- San Jose
- Coordinates:
- 37.3388, -121.8916
WHOIS Information
- Network Name:
- MSFT
- CIDR:
20.192.0.0/10- Owner:
- Microsoft Corporation
- Org ID:
MSFT- Address:
- One Microsoft Way, Redmond, WA 98052
- Reverse DNS:
-
inpost.tmcas.trendmicro.com
Last updated: 2/5/2026
Analysis
This IP is classified as a confounder: Trend Micro Cloud App Security (TMCAS) - Part of Trend Vision One(tm), Cloud Email and Collaboration Protection. An API-based security solution (for email and more), that protects MS Office 365, Google Workspace, Box and Dropbox. Phishing, ransomware, and BEC/DLP.. Failures observed from this source are expected artifacts of legitimate mail-handling behavior, typically email forwarding or mailing-list processing, and do not indicate spoofing attempts.
The host is operated by Microsoft Corporation and geolocates to San Jose, United States. Its presence in DMARC aggregate reports is an artifact of how forwarded mail interacts with SPF and DKIM authentication, not a sign of abuse originating from this address.
Administrators observing this IP in their DMARC aggregate reports should not block or treat it as hostile. This is an enterprise email security appliance. Mail routed through its relay infrastructure may appear in DMARC reports as authentication failures. Coordinate with your security vendor to ensure SPF alignment is maintained through the relay path.
Microsoft Network (365 vs Azure)
Differentiating between Office 365, including email protection services, and Azure (public cloud) when diagnosing incidents is challenging because they utilize shared Microsoft-owned IP ranges. Most of this is probably O365/Outlook or Defender protection breaking DKIM and SPF authentication. Disambiguation is a work-in-progress.
IP Confounder: Trend Micro Cloud App Security (TMCAS) - Part of Trend Vision One(tm), Cloud Email and Collaboration Protection. An API-based security solution (for email and more), that protects MS Office 365, Google Workspace, Box and Dropbox. Phishing, ransomware, and BEC/DLP.
Seems to break DKIM and SPF, thus DMARC.
Network Topology
External Reputation Lookups
Look up this IP in external threat intelligence and reputation databases (opens in new tab):
Nearby IPs
Other IPs in the 20.245.215.0/24 range observed failing DMARC:
20.245.215.65 (7 failures), 20.245.215.66 (6 failures), 20.245.215.68 (6 failures), 20.245.215.67 (4 failures), 20.245.215.69 (4 failures), 20.245.215.71 (4 failures), 20.245.215.70 (3 failures)