Sh4mefulNetwork: MSFT
Differentiating between Office 365, including email protection services, and Azure (public cloud) when diagnosing incidents is challenging because they utilize shared Microsoft-owned IP ranges. Most of this is probably O365/Outlook or Defender protection breaking DKIM and SPF authentication. Disambiguation is a work-in-progress.
This page shows DMARC authentication failures originating from the MSFT network. Learn more about this data.
Analysis
This network has contributed 5 unique IP addresses across 6 failed authentication events, accounting for 8 messages. Activity spans from March 12, 2024 to May 5, 2026, with peak volume in February 2025 (2 events). The top countries by failure volume are United States (63%), The Netherlands (25%), India (13%). The most active source IPs from this network include 40.74.181.208 (2 failures), 4.240.39.194 (1 failure), 20.241.204.101 (1 failure). The distribution across MSFT (Microsoft) suggests mixed or general-purpose infrastructure.