Domain

recent.api.office.net

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .net TLD

Run a live full scan of recent.api.office.net

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

100

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

seen in DNS

Observed Certs

131

in our scans

DNS Records

52.110.0.110, 52.110.0.146, 52.110.0.149, 52.110.0.15, 52.110.0.154, 52.110.0.16, 52.110.0.160, 52.110.0.56

AAAA

2603:1063:2001:10::365:ff1, 2603:1063:2001:1d::365:ff1, 2603:1063:2001:2206::365:ff1, 2603:1063:2001:2208::365:ff1, 2603:1063:2001:220e::365:ff1, 2603:1063:2001:2212::365:ff1, 2603:1063:2001:2213::365:ff1, 2603:1063:2001:2215::365:ff1

—

TXT

—

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

52.109.68.2:443 bebc511ae556…

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

SANs: *.ocws-df.officeapps.live.com, *.ocws.officeapps.live.com, *.officeapps.live.com, *.recent.svc.cloud.microsoft, ocws-df.officeapps.live.com, ocws-eu.officeapps.live.com, ocws-usdc.officeapps.live.com, ocws.officeapps.live.com, recent.api.office.net, recent.svc.cloud.microsoft

52.109.28.50:443 f2ffb67ae2db…

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

52.109.4.22:443 b58c1254fb93…

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 02

52.109.156.1:443 06499cf32f52…

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 04

52.109.88.188:443 3e212bd28bf6…

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

IPs Citing This Domain

No citing IPs found yet

As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

CT-Log Evidence

Certificates from public Certificate Transparency logs whose subject or SAN names this domain — including historic certs we never observed live.

ab16446c6b4732b7… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 04

SANs: ocws.officeapps.live.com, *.officeapps.live.com, ocws-usdc.officeapps.live.com, *.ocws.officeapps.live.com, recent.api.office.net, ocws-df.officeapps.live.com, *.ocws-df.officeapps.live.com, ocws-eu.officeapps.live.com, *.recent.svc.cloud.microsoft, recent.svc.cloud.microsoft

Valid: 2026-04-03 13:50:48 → 2026-09-30 13:50:48

b66105f1cda51065… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 04

Valid: 2026-04-03 13:44:07 → 2026-09-30 13:44:07

4b74ca290c59f949… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-04-03 13:37:59 → 2026-09-30 13:37:59

70c785fd856345cb… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

SANs: ocws.officeapps.live.com, *.officeapps.live.com, *.recent.svc.cloud.microsoft, recent.svc.cloud.microsoft, ocws-usdc.officeapps.live.com, *.ocws.officeapps.live.com, recent.api.office.net, ocws-df.officeapps.live.com, *.ocws-df.officeapps.live.com, ocws-eu.officeapps.live.com

Valid: 2026-04-03 13:37:43 → 2026-09-30 13:37:43

9ae76109b9957ceb… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-04-03 12:50:23 → 2026-09-30 12:50:23

03895d83fab0b34d… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

Valid: 2026-04-03 09:03:04 → 2026-09-30 09:03:04

add6c33246340280… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

Valid: 2026-04-03 08:43:23 → 2026-09-30 08:43:23

a94aa9a7d2933678… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 04

Valid: 2026-04-03 08:24:19 → 2026-09-30 08:24:19

c3d4afc3cf6835a6… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

Valid: 2026-04-03 08:20:01 → 2026-09-30 08:20:01

155c82270d734303… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-04-03 07:26:28 → 2026-09-30 07:26:28

8d791fdece106d7e… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 02

Valid: 2026-04-03 02:08:59 → 2026-09-30 02:08:59

2b5afd2aab870c3e… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

Valid: 2026-04-03 02:04:07 → 2026-09-30 02:04:07

8686f53693a75a2b… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-03-30 21:23:35 → 2026-09-26 21:23:35

07112dd581396947… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-03-30 10:35:08 → 2026-09-26 10:35:08

a873301033ab9a33… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 02

Valid: 2026-03-30 07:04:51 → 2026-09-26 07:04:51

11c1961285fa121d… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

Valid: 2026-03-30 04:46:30 → 2026-09-26 04:46:30

26efb6eb0c30539f… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 16

Valid: 2026-03-29 23:33:52 → 2026-09-25 23:33:52

64d9cbff61824da3… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-03-29 23:01:55 → 2026-09-25 23:01:55

f230fc1e3ce48f5b… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-03-29 22:09:54 → 2026-09-25 22:09:54

a2f6b6b7314e3788… google · xenon2026h2

Subject: ocws.officeapps.live.com

Issuer: Microsoft TLS G2 RSA CA OCSP 10

Valid: 2026-03-29 19:51:38 → 2026-09-25 19:51:38

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Domain timeline pending

Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.