Domain
microsoftonline.com
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of microsoftonline.com
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
—
AAAA
—
MX
10 messaging-microsoft-com.mail.protection.outlook.com
NS
ns1-38.azure-dns.com, ns2-38.azure-dns.net, ns3-38.azure-dns.org, ns4-38.azure-dns.info
TXT
google-site-verification=CNZTg2P9nNfuZUJdHTYBONoHbOjMq7UPVvxoqMgomfQ, google-site-verification=y-tlrGiMNJkBF1UO4Xk0GjbVwYk3p5urCieV9B1sHJ0, v=spf1 ip4:216.32.180.228 include:spfa.microsoftonline.com include:spf-exacttarget.microsoftonline.com include:spf-msods.microsoftonline.com include:spf-mfa.microsoftonline.com include:_spf-ssg-a.microsoft.com -all
CNAME
—
CAA
0 contactemail "caarecordaware@microsoft.com", 0 iodef "mailto:domains@microsoft.com", 0 issue "digicert.com", 0 issue "entrust.net", 0 issue "globalsign.com", 0 issue "microsoft.com"
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Subdomain enumeration pending
Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: login.microsoftonline.com
Issuer: Microsoft RSA TLS CA 02
SANs: *.windows.net, login.microsoftonline.com
Subject: login.microsoftonline.com
Issuer: Microsoft RSA TLS CA 02
SANs: *.windows.net, login.microsoftonline.com
Subject: cloud.email.microsoftonline.com
Issuer: Microsoft Azure RSA TLS Issuing CA 08
SANs: cloud.email.microsoftonline.com
Subject: login.microsoftonline.com
Issuer: Microsoft RSA TLS CA 02
SANs: *.windows.net, login.microsoftonline.com
Subject: login.microsoftonline.com
Issuer: Microsoft RSA TLS CA 02
SANs: *.windows.net, login.microsoftonline.com
Subject: microsoftonline.com.mail.crmcustomersinc.com
Issuer: GeoTrust TLS RSA CA G1
SANs: microsoftonline.com.mail.crmcustomersinc.com
Subject: login.microsoftonline.com
Issuer: Microsoft RSA TLS CA 02
SANs: *.windows.net, login.microsoftonline.com
Subject: login.microsoftonline.com
Issuer: Microsoft RSA TLS CA 02
SANs: *.windows.net, login.microsoftonline.com
IPs Citing This Domain
No citing IPs found yet
As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 81.85.77.103 | AS62904 | AS8075 | 95% | cert fd3b639f… served by 81.85.77.103 (AS62904) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 40.126.31.129, 20.190.159.68, 2603:1027:1:28::1e, 40.126.31.3 |
| 31.59.93.105 | AS56594 | AS8075 | 95% | cert 42346111… served by 31.59.93.105 (AS56594) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.160.67, 2603:1027:1:108::7, 2603:1026:3000:108::4, 2603:1026:3000:110::5 |
| 77.238.229.179 | AS216071 | AS8075 | 95% | cert b87a9c44… served by 77.238.229.179 (AS216071) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.231.128.67, 40.126.53.10, 20.231.128.66, 40.126.53.18 |
| 185.242.85.11 | AS209847 | AS8075 | 95% | cert 0cb6ffff… served by 185.242.85.11 (AS209847) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 40.126.32.74, 20.190.160.14, 2603:1027:1:d0::4, 40.126.32.72 |
| 78.17.3.134 | AS213459 | AS8075 | 95% | cert f1b9b159… served by 78.17.3.134 (AS213459) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.177.19, 20.190.177.21, 20.190.177.84, 2603:1027:1:108::10 |
| 185.255.178.31 | AS41745 | AS8075 | 95% | cert feade44e… served by 185.255.178.31 (AS41745) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.159.129, 40.126.31.67, 40.126.31.3, 2603:1027:1:28::e |
| 46.224.209.200 | AS24940 | AS8075 | 95% | cert 2d4c2aa2… served by 46.224.209.200 (AS24940) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1027:1:150::3, 20.190.177.83, 20.190.177.22, 2603:1026:3000:150::5 |
| 65.108.94.233 | AS24940 | AS8075 | 95% | cert 2d4c2aa2… served by 65.108.94.233 (AS24940) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.159.130, 40.126.31.67, 40.126.31.129, 20.190.159.4 |
| 31.77.73.160 | AS200173 | AS8075 | 95% | cert f1b9b159… served by 31.77.73.160 (AS200173) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1027:1:c8::3, 2603:1026:3000:d8::2, 20.190.147.11, 2603:1026:3000:d8::3 |
| 2.27.39.225 | AS215590 | AS8075 | 95% | cert 16b8ecae… served by 2.27.39.225 (AS215590) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1027:1:c8::3, 2603:1026:3000:d8::2, 20.190.147.11, 2603:1026:3000:d8::3 |
| 2.27.39.225 | AS215590 | AS8075 | 95% | cert feade44e… served by 2.27.39.225 (AS215590) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1027:1:c8::3, 2603:1026:3000:d8::2, 20.190.147.11, 2603:1026:3000:d8::3 |
| 45.8.93.209 | AS215439 | AS8075 | 95% | cert 286e71d0… served by 45.8.93.209 (AS215439) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1027:1:c8::3, 2603:1026:3000:d8::2, 20.190.147.11, 2603:1026:3000:d8::3 |
| 80.69.173.74 | AS202053 | AS8075 | 95% | cert 394e114f… served by 80.69.173.74 (AS202053) carries SAN ccs.login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1026:c0d:100b::2, 2603:1026:c0d:100d::2, 52.97.250.242, 52.98.232.18 |
| 178.255.222.58 | AS56971 | AS8075 | 95% | cert 42346111… served by 178.255.222.58 (AS56971) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.160.5, 2603:1026:3000:158::4, 2603:1026:3000:148::7, 2603:1027:1:150::3 |
| 155.212.164.59 | AS29182 | AS8075 | 95% | cert 286e71d0… served by 155.212.164.59 (AS29182) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.160.5, 2603:1026:3000:158::4, 2603:1026:3000:148::7, 2603:1027:1:150::3 |
| 192.55.236.27 | AS4972 | AS8075 | 95% | cert 56f3d78e… served by 192.55.236.27 (AS4972) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1026:3000:158::3, 20.190.159.131, 20.190.159.130, 40.126.31.3 |
| 185.242.85.11 | AS209847 | AS8075 | 95% | cert e9cbb3fa… served by 185.242.85.11 (AS209847) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.160.14, 2603:1026:3000:148::6, 40.126.32.133, 2603:1027:1:158::8 |
| 151.236.20.130 | AS9009 | AS8075 | 95% | cert 0cb6ffff… served by 151.236.20.130 (AS9009) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.159.71, 2603:1027:1:158::8, 2603:1027:1:148::f, 20.190.159.131 |
| 2.26.114.9 | AS213877 | AS8075 | 95% | cert 394e114f… served by 2.26.114.9 (AS213877) carries SAN ccs.login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1026:c0d:100b::2, 2603:1026:c0d:100d::2, 52.97.250.242, 52.98.232.18 |
| 31.56.27.12 | AS56971 | AS8075 | 95% | cert f1b9b159… served by 31.56.27.12 (AS56971) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 20.190.159.68, 40.126.31.130, 2603:1026:3000:150::8, 2603:1026:3000:148::6 |
| 49.13.11.174 | AS24940 | AS8075 | 95% | cert 2d4c2aa2… served by 49.13.11.174 (AS24940) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1026:3000:150::8, 2603:1027:1:150::4, 2603:1026:3000:158::2, 2603:1027:1:148::4 |
| 157.22.199.92 | AS29182 | AS8075 | 95% | cert feade44e… served by 157.22.199.92 (AS29182) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 2603:1027:1:150::4, 2603:1026:3000:150::c, 20.190.159.64, 40.126.31.71 |
| 65.109.163.96 | AS24940 | AS8075 | 95% | cert 2d4c2aa2… served by 65.109.163.96 (AS24940) carries SAN login.microsoftonline.com which currently resolves through Microsoft (AS8075) at 40.126.31.71, 20.190.159.130, 20.190.159.68, 40.126.31.67 |
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| CAA | 0 issue "microsoft.com" | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| NS | ns2-38.azure-dns.net | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| NS | ns4-38.azure-dns.info | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| TXT | google-site-verification=CNZTg2P9nNfuZUJdHTYBONoHbOjMq7UPVvxoqMgomfQ | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| CAA | 0 contactemail "caarecordaware@microsoft.com" | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| CAA | 0 issue "entrust.net" | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| CAA | 0 iodef "mailto:domains@microsoft.com" | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| MX | 10 messaging-microsoft-com.mail.protection.outlook.com | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| NS | ns3-38.azure-dns.org | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| TXT | google-site-verification=y-tlrGiMNJkBF1UO4Xk0GjbVwYk3p5urCieV9B1sHJ0 | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| CAA | 0 issue "digicert.com" | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| TXT | v=spf1 ip4:216.32.180.228 include:spfa.microsoftonline.com include:spf-exacttarget.microsoftonline.com include:spf-msods.microsoftonline.com include:spf-mfa.microsoftonline.com include:_spf-ssg-a.microsoft.com -all | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| CAA | 0 issue "globalsign.com" | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |
| NS | ns1-38.azure-dns.com | 2026-07-15 20:04:13.980 | 2026-07-15 20:04:13.980 |