Sh4mefulNetwork: MNA-95 ⚠ Confounder
⚠ Confounder Detected: Mimecast Email Security Gateway
Mimecast is a cloud-based email security gateway that enterprises route all inbound and outbound corporate email through for spam filtering, malware scanning, URL click-protection, and archiving. It breaks DKIM authentication by modifying message bodies during inline security processing — URL rewriting and footer insertion invalidate the original DKIM body hash. On the SPF side, Mimecast relay IPs become the actual sending IPs, breaking SPF alignment unless the domain owner has explicitly included Mimecast netblocks in their SPF record and enabled SPF alignment in the Mimecast admin console. DMARC failures originating from Mimecast IP ranges are almost always legitimate corporate email with a configuration gap, not spoofing or spam attempts.
Mimecast is a cloud-based email security gateway that enterprises route all inbound and outbound corporate email through for spam filtering, malware scanning, URL click-protection, and archiving. It breaks DKIM authentication by modifying message bodies during inline security processing — URL rewriting and footer insertion invalidate the original DKIM body hash. On the SPF side, Mimecast relay IPs become the actual sending IPs, breaking SPF alignment unless the domain owner has explicitly included Mimecast netblocks in their SPF record and enabled SPF alignment in the Mimecast admin console. DMARC failures originating from Mimecast IP ranges are almost always legitimate corporate email with a configuration gap, not spoofing or spam attempts.
This page shows DMARC authentication failures originating from the MNA-95 network. Learn more about this data.
Analysis
This network has contributed 26 unique IP addresses across 206 failed authentication events, accounting for 320 messages. Activity spans from September 6, 2024 to June 24, 2026, with peak volume in September 2024 (29 events). The top countries by failure volume are United States (100%). The most active source IPs from this network include 170.10.151.122 (42 failures), 170.10.128.131 (41 failures), 170.10.153.122 (40 failures). Failures from MNA-95 (Mimecast) are concentrated in a single country, which may indicate a targeted campaign or regionally hosted infrastructure.
Failures Detected from this Network
Showing 1-50 of 206 failures, affecting 320 messages| Date ▼ | Source IP | Country | Messages |
|---|---|---|---|
| 6/24/2026 | US | 3 | |
| 6/24/2026 | US | 3 | |
| 6/20/2026 | US | 1 | |
| 6/20/2026 | US | 1 | |
| 6/19/2026 | US | 2 | |
| 6/19/2026 | US | 2 | |
| 6/18/2026 | US | 2 | |
| 6/6/2026 | US | 2 | |
| 6/5/2026 | US | 4 | |
| 6/4/2026 | US | 1 | |
| 5/16/2026 | US | 2 | |
| 5/15/2026 | US | 2 | |
| 5/15/2026 | US | 2 | |
| 5/14/2026 | US | 1 | |
| 4/10/2026 | US | 3 | |
| 4/10/2026 | US | 1 | |
| 4/9/2026 | US | 1 | |
| 3/27/2026 | US | 1 | |
| 3/27/2026 | US | 1 | |
| 3/26/2026 | US | 1 | |
| 3/14/2026 | US | 1 | |
| 3/14/2026 | US | 1 | |
| 3/13/2026 | US | 1 | |
| 3/13/2026 | US | 3 | |
| 3/12/2026 | US | 1 | |
| 2/28/2026 | US | 2 | |
| 2/27/2026 | US | 1 | |
| 2/27/2026 | US | 3 | |
| 2/26/2026 | US | 1 | |
| 1/28/2026 | US | 2 | |
| 1/28/2026 | US | 2 | |
| 1/14/2026 | US | 1 | |
| 1/14/2026 | US | 1 | |
| 1/7/2026 | US | 2 | |
| 1/7/2026 | US | 2 | |
| 12/19/2025 | US | 3 | |
| 12/19/2025 | US | 1 | |
| 12/10/2025 | US | 1 | |
| 12/10/2025 | US | 3 | |
| 12/6/2025 | US | 2 | |
| 12/5/2025 | US | 1 | |
| 12/5/2025 | US | 3 | |
| 12/3/2025 | US | 3 | |
| 12/3/2025 | US | 1 | |
| 11/22/2025 | US | 2 | |
| 11/21/2025 | US | 1 | |
| 11/21/2025 | US | 3 | |
| 11/15/2025 | US | 1 | |
| 11/15/2025 | US | 1 | |
| 11/14/2025 | US | 1 |
Countries