Sh4meful DMARC Spoof Detection
Network: MSFT
Differentiating between Office 365, including email protection services, and Azure (public cloud) when diagnosing incidents is challenging because they utilize shared Microsoft-owned IP ranges. Most of this is probably O365/Outlook or Defender protection breaking DKIM and SPF authentication. Disambiguation is a work-in-progress.
About this Data
▶The data here is from DMARC analysis for domains I administer, drawn from a larger dataset (comprising millions of authentication records and messages). These entries are from email attempts that failed both SPF and DKIM (and there are often alignment issues - hidden here). In many cases, these failures indicate unauthorized use of the domain name, and are commonly associated with spoofing, phishing, or other abusive mail activity.
Failures Detected from this Network
Showing 3,101-3,150 of 9,818 (failures, affecting 12,565 messages)| Date ▼ | Source IP | Country | Messages |
|---|---|---|---|
| 5/14/2025 | US | 1 | |
| 5/14/2025 | US | 1 | |
| 5/14/2025 | US | 2 | |
| 5/14/2025 | US | 1 | |
| 5/14/2025 | US | 2 | |
| 5/14/2025 | IE | 1 | |
| 5/14/2025 | US | 1 | |
| 5/14/2025 | US | 1 | |
| 5/13/2025 | NL | 1 | |
| 5/13/2025 | IE | 1 | |
| 5/13/2025 | IE | 1 | |
| 5/13/2025 | AT | 1 | |
| 5/13/2025 | AT | 1 | |
| 5/13/2025 | AT | 1 | |
| 5/13/2025 | NL | 1 | |
| 5/13/2025 | US | 1 | |
| 5/9/2025 | IE | 1 | |
| 5/9/2025 | AT | 1 | |
| 5/9/2025 | AT | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | IN | 1 | |
| 5/9/2025 | IN | 2 | |
| 5/9/2025 | IN | 1 | |
| 5/9/2025 | IN | 1 | |
| 5/9/2025 | IN | 1 | |
| 5/9/2025 | IN | 1 | |
| 5/9/2025 | IN | 1 | |
| 5/9/2025 | AU | 1 | |
| 5/9/2025 | US | 1 | |
| 5/9/2025 | US | 1 |