Suspicious DNS activity associated with Outlook.com Junk Email — inconsistent AI threat detection

I recently investigated suspicious DNS activity recorded by NextDNS between 27 October and 2 November 2026.

By correlating my NextDNS logs with Brave browser history, I identified 310 DNS requests involving three suspicious domain families:

DomainRequestsBlocked by NextDNS

All 310 requests occurred within five seconds of navigating to individual messages in Outlook.com's Junk Email folder. Most occurred within two seconds.

I did not deliberately click any links to these domains.

NextDNS blocked 177 requests using AI-Driven Threat Detection. The remaining 133 requests had no blocking status recorded.

I would appreciate clarification on the following:

1. Are these domains recognised as malicious or associated with a known campaign?
2. Why did AI-Driven Threat Detection block some of these requests but not others?
3. Are the three domain families related?
4. Should the domains that were not blocked be added to NextDNS threat detection?

The last suspicious DNS activity was recorded on 2 November 2026 at approximately 18:09 AEDT. No further requests to these domain families appeared in my export through 3 November at 17:07 AEDT.

I have retained the original NextDNS logs and a detailed correlation analysis and can provide relevant extracts if required.

I have also reported the Outlook.com behaviour to Microsoft.

Thank you.