Sh4mefulIP Address: 52.101.62.99 ⚠ IP Confounder
IP address 52.101.62.99 is registered to Microsoft Corporation and geolocates to Des Moines, United States. It was observed in sh4meful's dataset on June 24, 2026. Over the observation window, it has failed DMARC alignment once, targeting one sender domain. Its reverse DNS resolves to mail-centralusazon11021099.outbound.protection.outlook.com. Network context: this address sits within MSFT (Microsoft Corporation), a network sh4meful has observed producing 6 failures across 5 distinct IPs during the same window.
Failure Activity Over Time
Peak activity was observed in the week of June 22, 2026 with 1 failures recorded. Activity in the most recent 30-day window increased sharply compared with the prior period (1 vs 0 failures).
This page shows DMARC authentication failure data for this IP address. Learn more about this data.
Geolocation Information
- Country:
- US United States
- Region:
- Iowa
- City:
- Des Moines
- Coordinates:
- 41.6015, -93.6127
WHOIS Information
- Network Name:
- MSFT
- CIDR:
52.112.0.0/14, 52.96.0.0/12- Owner:
- Microsoft Corporation
- Org ID:
MSFT- Address:
- One Microsoft Way, Redmond, WA 98052
- Reverse DNS:
-
mail-centralusazon11021099.outbound.protection.outlook.com
Last updated: 2/5/2026
Analysis
This IP is classified as a confounder: Microsoft 365 Exchange Online Protection (EOP). Failures observed from this source are expected artifacts of legitimate mail-handling behavior, typically email forwarding or mailing-list processing, and do not indicate spoofing attempts.
The host is operated by Microsoft Corporation and geolocates to Des Moines, United States. Its presence in DMARC aggregate reports is an artifact of how forwarded mail interacts with SPF and DKIM authentication, not a sign of abuse originating from this address.
Administrators observing this IP in their DMARC aggregate reports should not block or treat it as hostile. Microsoft Exchange Online Protection (EOP) and Office 365 relay addresses appear in DMARC reports for mail routed through Microsoft's filtering infrastructure. Ensure your SPF record includes Microsoft's published mail server ranges.
Microsoft Network (365 vs Azure)
Differentiating between Office 365, including email protection services, and Azure (public cloud) when diagnosing incidents is challenging because they utilize shared Microsoft-owned IP ranges. Most of this is probably O365/Outlook or Defender protection breaking DKIM and SPF authentication. Disambiguation is a work-in-progress.
IP Confounder: Microsoft 365 Exchange Online Protection (EOP)
Covers 52.100-103.x.x outbound; PTR: *.outbound.protection.outlook.com
Network Topology
This address is part of MSFT (Microsoft Corporation), announced from United States. 5 IPs in this network have been observed in sh4meful's dataset.
External Reputation Lookups
Look up this IP in external threat intelligence and reputation databases (opens in new tab):
Nearby IPs
The following IP addresses share the same /24 subnet as 52.101.62.99 and have appeared in sh4meful's dataset. Related activity in nearby addresses often indicates infrastructure operated by a single actor or provider.
- 52.101.62.123 — 4 failures, first seen 1 year ago, 642 days before this address.
- 52.101.62.111 — 2 failures, first seen 1 year ago, 635 days before this address.
- 52.101.62.118 — 2 failures, first seen 1 year ago, 553 days before this address.
- 52.101.62.30 — 2 failures, first seen 1 year ago, 553 days before this address.
- 52.101.62.46 — 2 failures, first seen 1 year ago, 483 days before this address.
- 52.101.62.80 — 2 failures, first seen 1 year ago, 589 days before this address.
- 52.101.62.108 — 1 failure, first seen 1 year ago, 580 days before this address.
- 52.101.62.105 — 1 failure, first seen 1 year ago, 635 days before this address.
Recommended Action
If this IP appears in your own DMARC reports, treat it as an unauthorized sender unless you have specifically verified it as a legitimate service you use. Ensure your DMARC policy is at p=quarantine or p=reject to prevent delivery of messages this IP claims to send from your domain. If you're new to DMARC, our complete guide walks through the mechanics.