Sh4meful
IP Address: 209.85.220.69 ⚠ IP Confounder
⚠ IP Confounder Detected: Google (mail-sor-f69.google.com)
The server, mail-sor-f69.google.com (IP address 209.85.220.69), belongs to Google and is acting as an outbound mail server for Gmail/Google Workspace users. While part of Google's network, it has been reported for sending emails that may fail SPF or DMARC alignment, often because the sending domain's SPF record does not include this specific IP or the DKIM signature is missing. Key Details Regarding 209.85.220.69: - Validity: It is a legitimate Google IP, generally not considered a "bad bot," but it is frequently involved in reporting scenarios where emails fail authentication. Sources: Gemini (retrieved 29-Jan), Dmarcian (https://forum.dmarcian.com/t/google-server-69-failing-dkim/1758)
The server, mail-sor-f69.google.com (IP address 209.85.220.69), belongs to Google and is acting as an outbound mail server for Gmail/Google Workspace users. While part of Google's network, it has been reported for sending emails that may fail SPF or DMARC alignment, often because the sending domain's SPF record does not include this specific IP or the DKIM signature is missing. Key Details Regarding 209.85.220.69: - Validity: It is a legitimate Google IP, generally not considered a "bad bot," but it is frequently involved in reporting scenarios where emails fail authentication. Sources: Gemini (retrieved 29-Jan), Dmarcian (https://forum.dmarcian.com/t/google-server-69-failing-dkim/1758)
ℹ️ Network Annotation: Google, and Google Cloud Platform (GCP)
Last updated: 1/29/2026
This is (part of) the GCP public cloud. Some email protection services run in GCP, but it is also an attack/spam vector.
About this Data
▶The data here is from DMARC analysis for domains I administer, drawn from a larger dataset (comprising millions of authentication records and messages). These entries are from email attempts that failed both SPF and DKIM (and there are often alignment issues - hidden here). In many cases, these failures indicate unauthorized use of the domain name, and are commonly associated with spoofing, phishing, or other abusive mail activity.
Geolocation Information
- Country:
- US United States
- Coordinates:
- 37.751, -97.822
WHOIS Information
- Network Name:
- CIDR:
209.85.128.0/17- Reverse DNS:
-
mail-sor-f69.google.com
Last updated: 2/5/2026
Failures Detected from this IP
Showing 51-100 of 141 (failures, affecting 1,190 messages)| Date ▼ | Messages |
|---|---|
| 9/24/2025 | 4 |
| 9/23/2025 | 14 |
| 9/22/2025 | 2 |
| 9/19/2025 | 2 |
| 9/18/2025 | 7 |
| 9/16/2025 | 3 |
| 9/12/2025 | 3 |
| 9/11/2025 | 9 |
| 9/10/2025 | 4 |
| 9/9/2025 | 8 |
| 9/8/2025 | 6 |
| 9/4/2025 | 4 |
| 9/2/2025 | 6 |
| 7/31/2025 | 8 |
| 7/30/2025 | 6 |
| 7/22/2025 | 8 |
| 7/17/2025 | 5 |
| 7/16/2025 | 8 |
| 7/10/2025 | 8 |
| 7/8/2025 | 4 |
| 7/2/2025 | 5 |
| 7/1/2025 | 5 |
| 6/30/2025 | 5 |
| 6/26/2025 | 16 |
| 6/25/2025 | 3 |
| 6/24/2025 | 1 |
| 6/19/2025 | 3 |
| 6/18/2025 | 3 |
| 6/17/2025 | 3 |
| 6/11/2025 | 2 |
| 6/10/2025 | 3 |
| 6/5/2025 | 3 |
| 5/27/2025 | 11 |
| 5/22/2025 | 1 |
| 5/15/2025 | 5 |
| 5/13/2025 | 9 |
| 5/8/2025 | 11 |
| 5/6/2025 | 1 |
| 5/1/2025 | 16 |
| 4/30/2025 | 2 |
| 4/29/2025 | 5 |
| 4/24/2025 | 1 |
| 4/22/2025 | 3 |
| 4/17/2025 | 1 |
| 4/10/2025 | 8 |
| 4/9/2025 | 246 |
| 3/27/2025 | 15 |
| 3/25/2025 | 4 |
| 3/18/2025 | 4 |
| 3/13/2025 | 15 |