Domain
officeapps.live
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of officeapps.live
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
—
AAAA
—
MX
—
NS
—
TXT
—
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.
| Subdomain | Resolves to | Last seen |
|---|---|---|
| ns1.officeapps.live | 2026-07-20 20:42:40.447 | |
| ns2.officeapps.live | 2026-07-20 20:42:40.447 | |
| ns3.officeapps.live | 2026-07-20 20:42:40.447 | |
| ns4.officeapps.live | 2026-07-20 20:42:40.447 | |
| 2ocws.officeapps.live | 2026-06-23 12:29:57.614 | |
| abaming.officeapps.live | 1970-01-01 00:00:00.000 | |
| access-point.clouing.officeapps.live | 2026-06-03 09:08:56.459 | |
| account.officeapps.live | 2026-07-20 20:42:40.447 | |
| accounts.officeapps.live | 2026-07-20 20:42:40.447 | |
| admin.officeapps.live | 2026-07-20 20:42:40.447 | |
| administrator.officeapps.live | 2026-07-20 20:42:40.447 | |
| adxcws.officeapps.live | 1970-01-01 00:00:00.000 | |
| akrvkwww.sdkodc.officeapps.live | 2026-07-20 09:01:44.965 | |
| alertmanager.officeapps.live | 2026-07-20 20:42:40.447 | |
| alpha.officeapps.live | 2026-07-20 20:42:40.447 | |
| am3-excel.officeapps.live | 1970-01-01 00:00:00.000 | |
| anlemetry.officeapps.live | 1970-01-01 00:00:00.000 | |
| api-v1.officeapps.live | 2026-07-20 20:42:40.447 | |
| api-v2.officeapps.live | 2026-07-20 20:42:40.447 | |
| api.officeapps.live | 2026-07-20 20:42:40.447 | |
| api1.officeapps.live | 2026-07-20 20:42:40.447 | |
| api2.officeapps.live | 2026-07-20 20:42:40.447 | |
| app.officeapps.live | 2026-07-20 20:42:40.447 | |
| apps.officeapps.live | 2026-07-20 20:42:40.447 | |
| archive.officeapps.live | 2026-07-20 20:42:40.447 | |
| argocd.officeapps.live | 2026-07-20 20:42:40.447 | |
| artifactory.officeapps.live | 2026-07-20 20:42:40.447 | |
| aspose.officeapps.live | 2026-06-18 14:18:20.205 | |
| assets.officeapps.live | 2026-07-20 20:42:40.447 | |
| auth.officeapps.live | 2026-07-20 20:42:40.447 | |
| autoconfig.officeapps.live | 2026-07-20 20:42:40.447 | |
| autodiscover.officeapps.live | 2026-07-20 20:42:40.447 | |
| backup.officeapps.live | 2026-07-20 20:42:40.447 | |
| backups.officeapps.live | 2026-07-20 20:42:40.447 | |
| balancer.officeapps.live | 2026-07-20 20:42:40.447 | |
| bamboo.officeapps.live | 2026-07-20 20:42:40.447 | |
| bastion.officeapps.live | 2026-07-20 20:42:40.447 | |
| beah.officeapps.live | 2026-07-14 22:07:36.777 | |
| beta.officeapps.live | 2026-07-20 20:42:40.447 | |
| bhwnwusc.pods.officeapps.live | 1970-01-01 00:00:00.000 | |
| billing.officeapps.live | 2026-07-20 20:42:40.447 | |
| bitbucket.officeapps.live | 2026-07-20 20:42:40.447 | |
| blog.officeapps.live | 2026-07-20 20:42:40.447 | |
| blogroaming.officeapps.live | 1970-01-01 00:00:00.000 | |
| bmawwwww.0962view.officeapps.live | 1970-01-01 00:00:00.000 | |
| bounce.officeapps.live | 2026-07-20 20:42:40.447 | |
| browser.eveming.officeapps.live | 1970-01-01 00:00:00.000 | |
| build.officeapps.live | 2026-07-20 20:42:40.447 | |
| buy.officeapps.live | 2026-07-20 20:42:40.447 | |
| cac-excel.officeapps.live | 1970-01-01 00:00:00.000 | |
| cache.officeapps.live | 2026-07-20 20:42:40.447 | |
| cacti.officeapps.live | 2026-07-20 20:42:40.447 | |
| canary.officeapps.live | 2026-07-20 20:42:40.447 | |
| cart.officeapps.live | 2026-07-20 20:42:40.447 | |
| cd.officeapps.live | 2026-07-20 20:42:40.447 | |
| cdc.officeapps.live | 1970-01-01 00:00:00.000 | |
| cdn.ocws.officeapps.live | 2026-06-03 08:48:52.483 | |
| cdn.officeapps.live | 2026-07-20 20:42:40.447 | |
| ch.pptservicescast.officeapps.live | 1970-01-01 00:00:00.000 | |
| checkout.officeapps.live | 2026-07-20 20:42:40.447 | |
| ci.officeapps.live | 2026-07-20 20:42:40.447 | |
| circleci.officeapps.live | 2026-07-20 20:42:40.447 | |
| clienuc-excel.officeapps.live | 1970-01-01 00:00:00.000 | |
| cliroaming.officeapps.live | 1970-01-01 00:00:00.000 | |
| clouing.officeapps.live | 1970-01-01 00:00:00.000 | |
| cng.officeapps.live | 2026-06-23 19:39:39.526 | |
| cocel-telemetry.officeapps.live | 2026-06-15 12:12:17.615 | |
| community.officeapps.live | 2026-07-20 20:42:40.447 | |
| confluence.officeapps.live | 2026-07-20 20:42:40.447 | |
| console.officeapps.live | 2026-07-20 20:42:40.447 | |
| contentlemetry.officeapps.live | 1970-01-01 00:00:00.000 | |
| conteroaming.officeapps.live | 1970-01-01 00:00:00.000 | |
| control.officeapps.live | 2026-07-20 20:42:40.447 | |
| corp.officeapps.live | 2026-07-20 20:42:40.447 | |
| cp.officeapps.live | 2026-07-20 20:42:40.447 | |
| cpanel.officeapps.live | 2026-07-20 20:42:40.447 | |
| cy.officeapps.live | 1970-01-01 00:00:00.000 | |
| da-edit.officeapps.live | 1970-01-01 00:00:00.000 | |
| dashboard.officeapps.live | 2026-07-20 20:42:40.447 | |
| database.officeapps.live | 2026-07-20 20:42:40.447 | |
| datadog.officeapps.live | 2026-07-20 20:42:40.447 | |
| db.officeapps.live | 2026-07-20 20:42:40.447 | |
| dec-excel.officeapps.live | 1970-01-01 00:00:00.000 | |
| demo.officeapps.live | 2026-07-20 20:42:40.447 | |
| deploy.officeapps.live | 2026-07-20 20:42:40.447 | |
| descarcac2rsetup.officeapps.live | 1970-01-01 00:00:00.000 | |
| designerapps.officeapps.live | 2026-06-16 00:55:32.816 | |
| dev.officeapps.live | 2026-07-20 20:42:40.447 | |
| develop.officeapps.live | 2026-07-20 20:42:40.447 | |
| development.officeapps.live | 2026-07-20 20:42:40.447 | |
| directadmin.officeapps.live | 2026-07-20 20:42:40.447 | |
| dl.officeapps.live | 2026-07-20 20:42:40.447 | |
| dns.officeapps.live | 2026-07-20 20:42:40.447 | |
| dns1.officeapps.live | 2026-07-20 20:42:40.447 | |
| dns2.officeapps.live | 2026-07-20 20:42:40.447 | |
| docker.officeapps.live | 2026-07-20 20:42:40.447 | |
| docs.officeapps.live | 2026-07-20 20:42:40.447 | |
| documentation.officeapps.live | 2026-07-20 20:42:40.447 | |
| downloads.officeapps.live | 2026-07-20 20:42:40.447 | |
| dzzmjxn--gzroaming-b2a.officeapps.live | 1970-01-01 00:00:00.000 | |
| edge-coowl.officeapps.live | 1970-01-01 00:00:00.000 | |
| edge.officeapps.live | 2026-07-20 20:42:40.447 | |
| edgeword-telemetry.officeapps.live | 2026-06-15 04:59:07.817 | |
| elastic.officeapps.live | 2026-07-20 20:42:40.447 | |
| encrypt.officeapps.live | 2026-07-20 20:42:40.447 | |
| es.officeapps.live | 2026-07-20 20:42:40.447 | |
| euc-collabrtc.officeapps.live | 2026-05-31 22:00:51.316 | |
| eurppc-powerpoint.officeapps.live | 2026-06-01 00:46:19.108 | |
| eus-odc.officeapps.live | 1970-01-01 00:00:00.000 | |
| eveming.officeapps.live | 1970-01-01 00:00:00.000 | |
| events.officeapps.live | 2026-07-20 20:42:40.447 | |
| ewivest.officeapps.live | 2026-06-16 17:32:45.680 | |
| exchange.officeapps.live | 2026-07-20 20:42:40.447 | |
| facebook-dima-news.officeapps.live | 2026-06-02 20:51:01.024 | |
| faelemetry.officeapps.live | 2026-07-18 10:49:40.670 | |
| faw.officeapps.live | 1970-01-01 00:00:00.000 | |
| ffc-collabrtcsc.officeapps.live | 2026-07-18 03:31:05.374 | |
| ffc-powerpoint-telemetry.officeapps.live | 2026-06-01 11:07:58.239 | |
| files.officeapps.live | 2026-07-20 20:42:40.447 | |
| findc.officeapps.live | 2026-06-15 16:53:52.830 |
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: offline.officeapps.live.com
Issuer: Microsoft IT TLS CA 1
SANs: *.officeapps-df.live.com, *.officeapps.live.com, offline.officeapps.live.com
Subject: wordcs.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 04
SANs: *.df.wordcs.svc.usercontent.microsoft, *.wordca.officeapps.live.com, *.wordcs.edog.officeapps.live.com, *.wordcs.officeapps.live.com, *.wordcs.svc.usercontent.microsoft, *.wordps.officeapps.live.com, df.wordcs.svc.usercontent.microsoft, wordca.officeapps.live.com, wordcs.edog.officeapps.live.com, wordcs.officeapps.live.com, wordcs.svc.usercontent.microsoft, wordps.officeapps.live.com
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 04
SANs: *.excel.cloud.microsoft, *.fp.measure.office.com, *.ocs.svc.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.word.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, online.office.com, online.office365.com
Subject: imganalysissvc.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 16
SANs: *.imageanalysis.core.microsoft, *.imganalysissvc.edog.officeapps.live.com, *.imganalysissvc.officeapps.live.com, imageanalysis.core.microsoft, imganalysissvc.edog.officeapps.live.com, imganalysissvc.officeapps.live.com, sdf.imageanalysis.core.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 04
SANs: *.excel.cloud.microsoft, *.fp.measure.office.com, *.ocs.svc.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.word.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, online.office.com, online.office365.com
Subject: wordcs.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 04
SANs: *.df.wordcs.svc.usercontent.microsoft, *.wordca.officeapps.live.com, *.wordcs.edog.officeapps.live.com, *.wordcs.officeapps.live.com, *.wordcs.svc.usercontent.microsoft, *.wordps.officeapps.live.com, df.wordcs.svc.usercontent.microsoft, wordca.officeapps.live.com, wordcs.edog.officeapps.live.com, wordcs.officeapps.live.com, wordcs.svc.usercontent.microsoft, wordps.officeapps.live.com
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: pptcs.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 02
SANs: *.df.pptcs.svc.usercontent.microsoft, *.pptca.officeapps.live.com, *.pptcs.edog.officeapps.live.com, *.pptcs.officeapps.live.com, *.pptcs.svc.usercontent.microsoft, *.pptps.officeapps.live.com, *.sacs.core.microsoft, *.sacs.officeapps.live.com, *.thfd.officeapps.live.com, *.thmw.officeapps.live.com, df.pptcs.svc.usercontent.microsoft, pptca.officeapps.live.com, pptcs.edog.officeapps.live.com, pptcs.officeapps.live.com, pptcs.svc.usercontent.microsoft, pptps.officeapps.live.com, sacs.core.microsoft, sacs.officeapps.live.com, thfd.officeapps.live.com, thmw.officeapps.live.com
Subject: textanalysis.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 04
SANs: *.index.textanalysis.core.microsoft, *.textanalysis.core.microsoft, *.textanalysis.edog.officeapps.live.com, *.textanalysis.officeapps.live.com, textanalysis.edog.officeapps.live.com, textanalysis.officeapps.live.com
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: designerapp.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 16
SANs: *.designerapp.officeapps.live.com, designerapp.officeapps.live.com
Subject: roaming.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.officeapps.live.com, *.osi.office.net, *.roaming-df.officeapps.live.com, *.roaming.officeapps.live.com, *.roaming.osi.office.net, *.roaming.svc.cloud.microsoft, roaming-df.officeapps.live.com, roaming-eu.officeapps.live.com, roaming.api.office.net, roaming.officeapps.live.com, roaming.osi.office.net, roaming.svc.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: pptmobius.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 02
SANs: *.pptmobius.edog.officeapps.live.com, *.pptmobius.officeapps.live.com, *.pptrender.slideanalysis.core.microsoft, *.slideanalysis.core.microsoft, *.slideinfoworker.slideanalysis.core.microsoft, pptmobius.edog.officeapps.live.com, pptmobius.officeapps.live.com, slideanalysis.core.microsoft
Subject: pptwrs.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 16
SANs: *.df.pptwrs.core.microsoft, *.pptwrs.core.microsoft, *.pptwrs.edog.officeapps.live.com, *.pptwrs.officeapps.live.com, df.pptwrs.core.microsoft, pptwrs.core.microsoft, pptwrs.edog.officeapps.live.com, pptwrs.officeapps.live.com
Subject: imganalysissvc.officeapps.live-int.com
Issuer: Microsoft TLS G2 RSA CA OCSP 02
SANs: *.imageanalysis.core.dev.microsoft, *.imganalysissvc.officeapps.live-int.com, imageanalysis.core.dev.microsoft, imganalysissvc.officeapps.live-int.com
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 16
SANs: *.excel.cloud.microsoft, *.ocs.svc.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.word.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, online.office.com, online.office365.com
Subject: pptmobius.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 02
SANs: *.pptmobius.edog.officeapps.live.com, *.pptmobius.officeapps.live.com, *.pptrender.slideanalysis.core.microsoft, *.slideanalysis.core.microsoft, *.slideinfoworker.slideanalysis.core.microsoft, pptmobius.edog.officeapps.live.com, pptmobius.officeapps.live.com, slideanalysis.core.microsoft
Subject: designerapp.officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 16
SANs: *.app.designer.svc.cloud.microsoft, *.designerapp.officeapps.live.com, app.designer.svc.cloud.microsoft, designerapp.officeapps.live.com
Subject: officeapps.live.com
Issuer: Microsoft TLS G2 RSA CA OCSP 10
SANs: *.excel.cloud.microsoft, *.office.core.microsoft, *.office.guest.usercontent.microsoft, *.office.live.com, *.office.svc.cloud.microsoft, *.officeapps-df.live.com, *.officeapps.live.com, *.online.office.com, *.online.office365.com, *.optin.online.office.com, *.powerpoint.cloud.microsoft, *.th.officeapps.live.com, *.vhs.officeapps.live.com, *.view.officeapps.live.com, *.wopi.office.core.microsoft, *.wopi.online.office.net, *.word.cloud.microsoft, *.wshi.office.core.microsoft, *.wshi.online.office.net, df.excel.cloud.microsoft, df.onenote.cloud.microsoft, df.powerpoint.cloud.microsoft, df.visio.cloud.microsoft, df.word.cloud.microsoft, excel.cloud-dev.microsoft, excel.cloud.dev.microsoft, excel.cloud.microsoft, office.live.com, officeapps-df.live.com, officeapps.live.com, officeppe.live.com, onenote.cloud.dev.microsoft, onenote.cloud.microsoft, online.office.com, online.office365.com, powerpoint.cloud-dev.microsoft, powerpoint.cloud.dev.microsoft, powerpoint.cloud.microsoft, tr-ofc-atm.office.com, visio.cloud.dev.microsoft, visio.cloud.microsoft, word.cloud-dev.microsoft, word.cloud.dev.microsoft, word.cloud.microsoft
IPs Citing This Domain
No citing IPs found yet
As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-IP leaks detected (yet)
Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.
CT-Log Evidence
Certificates from public Certificate Transparency logs whose subject or SAN names this domain — including historic certs we never observed live.
871823bd68541bbb…
cloudflare · nimbus2026
Subject: officeapps.live
Issuer: R13
SANs: *.officeapps.live, officeapps.live
Valid: 2025-10-17 09:12:51 → 2026-01-15 09:12:50
e1ef0987c5fb8353…
cloudflare · nimbus2026
Subject: officeapps.live
Issuer: R13
SANs: *.officeapps.live, officeapps.live
Valid: 2025-10-17 09:12:51 → 2026-01-15 09:12:50
871823bd68541bbb…
sectigo · elephant2026h1
Subject: officeapps.live
Issuer: R13
SANs: *.officeapps.live, officeapps.live
Valid: 2025-10-17 09:12:51 → 2026-01-15 09:12:50
581108284986526a…
google · xenon2026h1
Subject: officeapps.live
Issuer: R13
SANs: officeapps.live
Valid: 2025-10-03 22:25:21 → 2026-01-01 22:25:20
581108284986526a…
sectigo · elephant2026h1
Subject: officeapps.live
Issuer: R13
SANs: officeapps.live
Valid: 2025-10-03 22:25:21 → 2026-01-01 22:25:20
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Domain timeline pending
Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.