Sh4mefulIP Address: 2a01:111:f403:c10d::3 â IP Confounder
Exchange Online Protection (EOP) is a cloud-based email filtering service included with all Microsoft 365 subscriptions to protect against spam, malware, and phishing attacks. It automatically secures mailboxes by filtering incoming and outgoing messages in real-time using anti-spam, anti-malware, and content filters. During periods of active campaign activity, these can largely be ignored (esp. when recipients are on Exchange). However, forged emails have been observed from Microsoft infrastructure that have this signature too.
According to reverse-DNS, this is a host domain utilized by Microsoft 365 (formerly Office 365) to manage and secure outbound email traffic. It acts as a mail transfer agent (MTA) that filters outgoing messages to prevent spam and malicious content. Format: .outbound.protection.outlook.com. However, we've seen actual spoof attempts and SPAM from MS infrastructure so not classing this a confounder.
This page shows DMARC authentication failure data for this IP address. Learn more about this data.
Geolocation Information
- Country:
- US United States
- Region:
- Texas
- City:
- San Antonio
- Coordinates:
- 29.4227, -98.4927
WHOIS Information
- Network Name:
- UK-MICROSOFT-20060601
- Owner:
- ORG-MA42-RIPE
- Reverse DNS:
-
mail-southcentralusazlp170110003.outbound.protection.outlook.com
Last updated: 2/5/2026
Analysis
This IP was first observed on July 31, 2025 and most recently on April 10, 2026. It has been associated with 68 failed authentication events affecting 306 messages, representing significant volume. The IP belongs to UK-MICROSOFT-20060601 (ORG-MA42-RIPE), a network with activity associated with United States.
Failures Detected from this IP
Showing 1-50 of 68 (failures, affecting 306 messages)| Date Ⲡ| Messages |
|---|---|
| 7/31/2025 | 2 |
| 9/10/2025 | 4 |
| 9/11/2025 | 3 |
| 9/12/2025 | 7 |
| 9/13/2025 | 4 |
| 9/16/2025 | 1 |
| 9/17/2025 | 7 |
| 9/18/2025 | 10 |
| 9/19/2025 | 11 |
| 9/20/2025 | 3 |
| 9/23/2025 | 4 |
| 9/24/2025 | 19 |
| 9/25/2025 | 8 |
| 9/26/2025 | 25 |
| 9/30/2025 | 3 |
| 10/1/2025 | 8 |
| 10/2/2025 | 6 |
| 10/3/2025 | 8 |
| 10/4/2025 | 3 |
| 10/8/2025 | 7 |
| 10/9/2025 | 5 |
| 10/10/2025 | 11 |
| 10/21/2025 | 1 |
| 10/22/2025 | 3 |
| 10/23/2025 | 6 |
| 10/24/2025 | 6 |
| 10/25/2025 | 2 |
| 11/12/2025 | 5 |
| 11/13/2025 | 3 |
| 11/14/2025 | 4 |
| 11/19/2025 | 8 |
| 11/20/2025 | 13 |
| 11/21/2025 | 5 |
| 11/22/2025 | 2 |
| 12/3/2025 | 8 |
| 12/4/2025 | 3 |
| 12/5/2025 | 5 |
| 12/6/2025 | 2 |
| 12/9/2025 | 2 |
| 12/10/2025 | 3 |
| 12/11/2025 | 1 |
| 12/12/2025 | 1 |
| 12/17/2025 | 6 |
| 12/18/2025 | 6 |
| 12/19/2025 | 6 |
| 1/6/2026 | 1 |
| 1/7/2026 | 2 |
| 1/8/2026 | 1 |
| 1/9/2026 | 1 |
| 1/13/2026 | 1 |
External Reputation Lookups
Look up this IP in external threat intelligence and reputation databases (opens in new tab):