Domain

microsoftonline.com

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .com TLD

Run a live full scan of microsoftonline.com

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

1,142

A/AAAA targets

Subdomains

311

CT + scan + body

Record Types

seen in DNS

Observed Certs

—

in our scans

DNS Records

—

AAAA

—

10 messaging-microsoft-com.mail.protection.outlook.com

ns1-38.azure-dns.com, ns2-38.azure-dns.net, ns3-38.azure-dns.org, ns4-38.azure-dns.info

TXT

google-site-verification=CNZTg2P9nNfuZUJdHTYBONoHbOjMq7UPVvxoqMgomfQ, google-site-verification=y-tlrGiMNJkBF1UO4Xk0GjbVwYk3p5urCieV9B1sHJ0, v=spf1 ip4:216.32.180.228 include:spfa.microsoftonline.com include:spf-exacttarget.microsoftonline.com include:spf-msods.microsoftonline.com include:spf-mfa.microsoftonline.com include:_spf-ssg-a.microsoft.com -all

CNAME

—

CAA

0 contactemail "caarecordaware@microsoft.com", 0 iodef "mailto:domains@microsoft.com", 0 issue "digicert.com", 0 issue "entrust.net", 0 issue "globalsign.com", 0 issue "microsoft.com"

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain	Resolves to	Last seen
ccs.login.microsoftonline.com	40.99.205.34 2603:1026:c0d:1027::2 2603:1026:c0d:100b::2 2603:1026:c0d:1021::2 +588	2026-07-28 20:39:29.599
login.microsoftonline.com	40.126.31.128 2603:1027:1:c8::2 2603:1026:3000:c8::7 2603:1027:1:158::c +362	2026-07-28 23:56:20.652
logincert.microsoftonline.com	40.126.31.3 40.126.31.130 20.190.159.71 20.190.159.23 +335	2026-07-28 17:05:15.597
device.login.microsoftonline.com	40.126.53.13 2603:1036:3000:138::3 2603:1036:3000:138::5 2603:1026:3000:118::1 +230	2026-07-28 16:55:29.357
geo.logincert.microsoftonline.com	20.190.160.65 2603:1026:3000:d8::1 2603:1027:1:c8::2 2603:1026:3000:148::10 +212	2026-07-28 16:55:29.357
loginex.microsoftonline.com	40.126.32.68 2603:1026:3000:150::c 2603:1027:1:158::2 2603:1027:1:150::2 +211	2026-07-28 23:56:20.652
api.passwordreset.microsoftonline.com	40.126.32.131 40.126.32.129 40.126.32.6 20.190.181.19 +99	2026-07-28 17:05:15.597
passwordreset.microsoftonline.com	40.126.32.131 2603:1027:1:148::b 2603:1026:3000:150::2 2603:1027:1:28::19 +76	2026-07-28 17:05:15.597
companymanager.microsoftonline.com	40.126.53.1 2603:1026:3000:150::3 2603:1027:1:148::b 2603:1026:3000:150::2 +45	2026-07-28 13:14:14.650
login-us.microsoftonline.com	20.190.190.193 2603:1036:3000:f8::3 2603:1036:3000:e8::4 2603:1036:3000:f0::3 +44	2026-07-28 16:55:29.357
tip.passwordreset.microsoftonline.com	20.190.181.19 2603:1027:1:148::b 2603:1027:1:158::7 2603:1026:3000:150::3 +43	2026-07-28 16:55:29.357
becwsgw.microsoftonline.com	40.126.32.66 2603:1027:1:158::7 2603:1026:3000:150::3 2603:1036:3000:d0::3 +34	2026-06-03 14:47:00.650
adminwebservice.gov.us.microsoftonline.com	52.126.195.7 2001:489a:3500:48::4 2001:489a:3500:48::6 2001:489a:3500::9 +28	2026-07-19 19:09:52.275
becws-gov-us.microsoftonline.com	52.126.195.7 2001:489a:3500:48::1 2001:489a:3500:48:: 2001:489a:3500:48::3 +28	2026-06-22 09:39:16.569
provisioningapi.microsoftonline.com	40.126.32.66 2603:1026:3000:150::3 2603:1027:1:158::7 2603:1027:1:148::b +21	2026-06-03 14:47:00.650
becws.microsoftonline.com	40.126.32.131 2603:1026:3000:150::2 2603:1027:1:148::b 2603:1027:1:158::7 +20	2026-06-03 14:47:00.650
becws.gov.us.microsoftonline.com	52.126.195.34 2001:489a:3500:48::1 2001:489a:3500:48:: 2001:489a:3500:48::3 +16	2026-06-04 13:14:07.324
syncservice.gov.us.microsoftonline.com	52.126.195.74 2001:489a:3500::8 2001:489a:3500::9 2001:489a:3500::7 +16	2026-06-21 09:36:51.662
adminwebservice.microsoftonline.com	20.190.129.24 2603:1026:3000:d0::2 2603:1026:3000:d0::1 2603:1027:1:28::9 +14	2026-07-28 13:14:14.650
syncservice.microsoftonline.com	20.190.137.32 20.190.181.20 40.126.53.22 2603:1027:1:148::d +14	2026-07-28 13:14:14.650
certauth.login.microsoftonline.com	40.126.9.33 2603:1027:1:d0::1 2603:1027:1:d0:: 2603:1027:1:150:: +12	2026-07-28 23:56:20.652
image.email.microsoftonline.com	184.24.19.198 23.201.242.14 23.204.208.166 23.57.21.240 +1	2026-07-28 05:16:53.837
portal.microsoftonline.com	150.171.73.13 2603:1061:10::13 2603:1061:10:1::13 150.171.74.13	2026-07-28 09:41:22.792
ccs-sdf.login.microsoftonline.com		1970-01-01 00:00:00.000
cloud.email.microsoftonline.com	128.17.144.16	2026-07-21 18:01:40.440
commerce.microsoftonline.com	172.193.128.49	2026-07-25 23:00:05.858
frontdoor.rnrvalidator.microsoftonline.com		1970-01-01 00:00:00.000
login2.microsoftonline.com		1970-01-01 00:00:00.000
microsoftonline.com		1970-01-01 00:00:00.000
mmr.microsoftonline.com		1970-01-01 00:00:00.000
mmr.ppe.microsoftonline.com		1970-01-01 00:00:00.000
mocp.microsoftonline.com	65.55.171.150	2026-05-27 10:52:36.714
mosi.microsoftonline.com		1970-01-01 00:00:00.000
nisvpcauat.microsoftonline.com		1970-01-01 00:00:00.000
pgw.cp.partner.microsoftonline.com		1970-01-01 00:00:00.000
portalprv.microsoftonline.com		1970-01-01 00:00:00.000
prodccsstatecookie.microsoftonline.com		1970-01-01 00:00:00.000
provisioningapi-gov-us.microsoftonline.com		1970-01-01 00:00:00.000
provisioningapi.gov.us.microsoftonline.com		1970-01-01 00:00:00.000
prs-ncu.passwordreset.microsoftonline.com	0.0.0.0	2026-07-28 10:19:39.346
prs-scu.passwordreset.microsoftonline.com	0.0.0.0	2026-07-28 10:19:39.346
r.login.microsoftonline.com		1970-01-01 00:00:00.000
sanya-testtobedeleted.pcs.cp.microsoftonline.com		1970-01-01 00:00:00.000
sharepoint.apac.microsoftonline.com		1970-01-01 00:00:00.000
sharepoint.emea.microsoftonline.com		1970-01-01 00:00:00.000
sharepoint.microsoftonline.com		1970-01-01 00:00:00.000
signing.passwordreset.microsoftonline.com		1970-01-01 00:00:00.000
stamp2.login.microsoftonline.com		1970-01-01 00:00:00.000
test.certauth.login.microsoftonline.com		1970-01-01 00:00:00.000

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

49.13.11.174:443 2d4c2aa2ac74…

Subject: login.microsoftonline.com

Issuer: Microsoft RSA TLS CA 02

SANs: *.windows.net, login.microsoftonline.com

46.62.195.206:443 2d4c2aa2ac74…

Subject: login.microsoftonline.com

Issuer: Microsoft RSA TLS CA 02

SANs: *.windows.net, login.microsoftonline.com

128.17.144.16:443 e5e6b90341a6…

Subject: cloud.email.microsoftonline.com

Issuer: Microsoft Azure RSA TLS Issuing CA 08

SANs: cloud.email.microsoftonline.com

46.224.209.200:443 2d4c2aa2ac74…

Subject: login.microsoftonline.com

Issuer: Microsoft RSA TLS CA 02

SANs: *.windows.net, login.microsoftonline.com

65.108.94.233:443 2d4c2aa2ac74…

Subject: login.microsoftonline.com

Issuer: Microsoft RSA TLS CA 02

SANs: *.windows.net, login.microsoftonline.com

172.204.131.97:443 2f2d548df4e0…

Subject: microsoftonline.com.mail.crmcustomersinc.com

Issuer: GeoTrust TLS RSA CA G1

SANs: microsoftonline.com.mail.crmcustomersinc.com

49.13.11.174:443 2d4c2aa2ac74…

Subject: login.microsoftonline.com

Issuer: Microsoft RSA TLS CA 02

SANs: *.windows.net, login.microsoftonline.com

65.109.163.96:443 2d4c2aa2ac74…

Subject: login.microsoftonline.com

Issuer: Microsoft RSA TLS CA 02

SANs: *.windows.net, login.microsoftonline.com

IPs Citing This Domain

No citing IPs found yet

As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type	Value	First seen	Last seen
CAA	0 issue "microsoft.com"	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
NS	ns2-38.azure-dns.net	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
NS	ns4-38.azure-dns.info	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
TXT	google-site-verification=CNZTg2P9nNfuZUJdHTYBONoHbOjMq7UPVvxoqMgomfQ	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
CAA	0 contactemail "caarecordaware@microsoft.com"	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
CAA	0 issue "entrust.net"	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
CAA	0 iodef "mailto:domains@microsoft.com"	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
MX	10 messaging-microsoft-com.mail.protection.outlook.com	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
NS	ns3-38.azure-dns.org	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
TXT	google-site-verification=y-tlrGiMNJkBF1UO4Xk0GjbVwYk3p5urCieV9B1sHJ0	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
CAA	0 issue "digicert.com"	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
TXT	v=spf1 ip4:216.32.180.228 include:spfa.microsoftonline.com include:spf-exacttarget.microsoftonline.com include:spf-msods.microsoftonline.com include:spf-mfa.microsoftonline.com include:_spf-ssg-a.microsoft.com -all	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
CAA	0 issue "globalsign.com"	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980
NS	ns1-38.azure-dns.com	2026-07-15 20:04:13.980	2026-07-15 20:04:13.980