misp-warninglists/lists/microsoft-office365/list.json

345 lines
9.8 KiB
JSON

{
"description": "Office 365 URLs and IP address ranges",
"list": [
"a.wunderlist.com",
"aadrm.com",
"account.activedirectory.windowsazure.com",
"account.live.com",
"account.office.net",
"accounts.accesscontrol.windows.net",
"accounts.google.com",
"acompli.helpshift.com",
"acompli.net",
"activation.sls.microsoft.com",
"ad.atdmt.com",
"adl.windows.com",
"admin.microsoft.com",
"admin.onedrive.com",
"adminwebservice.microsoftonline.com",
"ajax.aspnetcdn.com",
"ajax.microsoft.com",
"aka.ms",
"amp.azure.net",
"amsglob0cdnstream11.azureedge.net",
"amsglob0cdnstream12.azureedge.net",
"analytics.localytics.com",
"api.dropboxapi.com",
"api.localytics.com",
"api.login.yahoo.com",
"api.meetup.com",
"api.microsoftstream.com",
"api.office.com",
"api.passwordreset.microsoftonline.com",
"apis.live.net",
"app.adjust.com",
"app.box.com",
"appex-rf.msn.com",
"appex.bing.com",
"apps.identrust.com",
"appsforoffice.microsoft.com",
"aria.microsoft.com",
"assets-yammer.com",
"assets.onestore.ms",
"attachments.office.net",
"auth.gfx.ms",
"autologon.microsoftazuread-sso.com",
"azure-apim.net",
"azureedge.net",
"azurerms.com",
"becws.microsoftonline.com",
"bit.ly",
"blob.core.windows.net",
"broadcast.officeapps.live.com",
"broadcast.skype.com",
"by.uservoice.com",
"c.bing.com",
"c.bing.net",
"c.live.com",
"c1.microsoft.com",
"cacerts.digicert.com",
"cdn.forms.office.net",
"cdn.odc.officeapps.live.com",
"cdn.office.net",
"cdn.onenote.net",
"cdn.optimizely.com",
"cdn.sharepointonline.com",
"cdnprod.myanalytics.microsoft.com",
"cert.int-x3.letsencrypt.org",
"cl2.apple.com",
"clientconfig.microsoftonline-p.net",
"cloudapp.net",
"companymanager.microsoftonline.com",
"compass-ssl.microsoft.com",
"config.office.net",
"connect.facebook.net",
"contentstorage.osi.office.net",
"crl.globalsign.com",
"crl.globalsign.net",
"crl.identrust.com",
"crl.microsoft.com",
"crl3.digicert.com",
"crl4.digicert.com",
"d.docs.live.net",
"data.flurry.com",
"dc.applicationinsights.microsoft.com",
"dc.services.visualstudio.com",
"device.login.microsoftonline.com",
"dgps.support.microsoft.com",
"directory.services.live.com",
"docs.live.net",
"docs.microsoft.com",
"ecn.dev.virtualearth.net",
"en-us.appex-rf.msn.com",
"enterpriseregistration.windows.net",
"entrust.net",
"eus-www.sway-cdn.com",
"eus-www.sway-extensions.com",
"events.data.microsoft.com",
"excel.officeapps.live.com",
"excelbingmap.firstpartyapps.oaspapps.com",
"excelcs.officeapps.live.com",
"files.sharepoint.com",
"firstpartyapps.oaspapps.com",
"flow.microsoft.com",
"foodanddrink.services.appex.bing.com",
"forms.microsoft.com",
"g.live.com",
"geotrust.com",
"go.microsoft.com",
"graph.facebook.com",
"graph.microsoft.com",
"graph.windows.net",
"helpshift.com",
"hip.live.com",
"hockeyapp.net",
"home.office.com",
"informationprotection.azure.com",
"informationprotection.hosting.portal.azure.net",
"insertmedia.bing.office.net",
"isrg.trustid.ocsp.identrust.com",
"itunes.apple.com",
"keydelivery.mediaservices.windows.net",
"localytics.com",
"log.optimizely.com",
"login-us.microsoftonline.com",
"login.live.com",
"login.microsoft.com",
"login.microsoftonline-p.com",
"login.microsoftonline.com",
"login.windows-ppe.net",
"login.windows.net",
"logincert.microsoftonline.com",
"loginex.microsoftonline.com",
"lpcres.delve.office.com",
"lync.com",
"m.facebook.com",
"mail.google.com",
"mail.protection.outlook.com",
"manage.microsoft.com",
"manage.office.com",
"management.azure.com",
"media.azure.net",
"mem.gfx.ms",
"microsoft.com",
"microsoftonline-p.com",
"microsoftonline.com",
"microsoftusercontent.com",
"mlccdn.blob.core.windows.net",
"mlccdnprod.azureedge.net",
"mrodevicemgr.officeapps.live.com",
"msauth.net",
"msauthimages.net",
"mscrl.microsoft.com",
"msdn.microsoft.com",
"msecnd.net",
"msedge.net",
"msftauth.net",
"msftauthimages.net",
"msftidentity.com",
"msidentity.com",
"msocdn.com",
"mstea.ms",
"myanalytics-gcc.microsoft.com",
"myanalytics.microsoft.com",
"myfiles.sharepoint.com",
"nexus.microsoftonline-p.com",
"nexus.officeapps.live.com",
"nexusrules.officeapps.live.com",
"notification.api.microsoftstream.com",
"nps.onyx.azure.net",
"o15.officeredir.microsoft.com",
"o365weve.com",
"ocos-office365-s2s.msedge.net",
"ocsa.officeapps.live.com",
"ocsp.digicert.com",
"ocsp.globalsign.com",
"ocsp.int-x3.letsencrypt.org",
"ocsp.msocsp.com",
"ocsp2.globalsign.com",
"ocspx.digicert.com",
"ocsredir.officeapps.live.com",
"ocws.officeapps.live.com",
"odc.officeapps.live.com",
"odcsm.officeapps.live.com",
"office.com",
"office.live.com",
"office.microsoft.com",
"office.net",
"office15client.microsoft.com",
"office365.com",
"office365servicehealthcommunications.cloudapp.net",
"officeapps.live.com",
"officecdn.microsoft.com",
"officecdn.microsoft.com.edgesuite.net",
"officeclient.microsoft.com",
"officeconfig.msocdn.com",
"officepreviewredir.microsoft.com",
"officeredir.microsoft.com",
"officespeech.platform.bing.com",
"ols.officeapps.live.com",
"omextemplates.content.office.net",
"omniroot.com",
"oneclient.sfx.ms",
"onenote.com",
"onenote.officeapps.live.com",
"online.office.com",
"onmicrosoft.com",
"osiprod-cus-daffodil-signalr-00.service.signalr.net",
"osiprod-neu-daffodil-signalr-00.service.signalr.net",
"osiprod-weu-daffodil-signalr-00.service.signalr.net",
"osiprod-wus-daffodil-signalr-00.service.signalr.net",
"outlook.com",
"outlook.office.com",
"outlook.office365.com",
"outlook.uservoice.com",
"outlookmobile.com",
"p100-sandbox.itunes.apple.com",
"partnerservices.getmicrosoftkey.com",
"passwordreset.microsoftonline.com",
"peoplegraph.firstpartyapps.oaspapps.com",
"phonefactor.net",
"platform.linkedin.com",
"play.google.com",
"policykeyservice.dc.ad.msft.net",
"portal.cloudappsecurity.com",
"portal.microsoftonline.com",
"portal.office.com",
"powerapps.com",
"powerpoint.officeapps.live.com",
"pptcs.officeapps.live.com",
"privatecdn.sharepointonline.com",
"prod.firstpartyapps.oaspapps.com.akadns.net",
"prod.msocdn.com",
"protection.office.com",
"protection.outlook.com",
"provisioningapi.microsoftonline.com",
"public-trust.com",
"publiccdn.sharepointonline.com",
"quicktips.skypeforbusiness.com",
"r.office.microsoft.com",
"r1.res.office365.com",
"r3.res.office365.com",
"r3.res.outlook.com",
"r4.res.office365.com",
"rink.hockeyapp.net",
"roaming.officeapps.live.com",
"rtc.officeapps.live.com",
"s.ytimg.com",
"s0.assets-yammer.com",
"sas.office.microsoft.com",
"sdk.hockeyapp.net",
"search.production.apac.trafficmanager.net",
"search.production.emea.trafficmanager.net",
"search.production.us.trafficmanager.net",
"secure.aadcdn.microsoftonline-p.com",
"secure.globalsign.com",
"secure.meetup.com",
"secure.skypeassets.com",
"sfbassets.com",
"shared.officeapps.live.com",
"sharepoint.com",
"sharepointonline.com",
"shellprod.msocdn.com",
"signup.live.com",
"signup.microsoft.com",
"skype.com",
"skypeforbusiness.com",
"skypemaprdsitus.trafficmanager.net",
"smtp.office365.com",
"social.yahooapis.com",
"spoprod-a.akamaihd.net",
"ssw.live.com",
"staffhub.ms",
"staffhub.uservoice.com",
"staffhubweb.azureedge.net",
"static.sharepointonline.com",
"statics.teams.microsoft.com",
"storage.live.com",
"streaming.mediaservices.windows.net",
"suite.office.net",
"support.content.office.net",
"support.microsoft.com",
"support.office.com",
"svc.ms",
"sway.com",
"symcb.com",
"symcd.com",
"teams.microsoft.com",
"technet.microsoft.com",
"telemetryservice.firstpartyapps.oaspapps.com",
"tenor.com",
"testconnectivity.microsoft.com",
"tse1.mm.bing.net",
"uci.officeapps.live.com",
"urlp.sfbassets.com",
"users.storage.live.com",
"verisign.com",
"verisign.net",
"videocontent.osi.office.net",
"videoplayercdn.osi.office.net",
"view.atdmt.com",
"view.officeapps.live.com",
"visio.officeapps.live.com",
"vortex.data.microsoft.com",
"watson.microsoft.com",
"watson.telemetry.microsoft.com",
"weather.tile.appex.bing.com",
"web.localytics.com",
"web.microsoftstream.com",
"webanalytics.localytics.com",
"wikipedia.firstpartyapps.oaspapps.com",
"wns.windows.com",
"word-edit.officeapps.live.com",
"wordcs.officeapps.live.com",
"workplaceanalytics.cdn.office.net",
"workplaceanalytics.office.com",
"wus-firstpartyapps.oaspapps.com",
"wus-www.sway-cdn.com",
"wus-www.sway-extensions.com",
"www.acompli.com",
"www.bing.com",
"www.digicert.com",
"www.dropbox.com",
"www.evernote.com",
"www.google-analytics.com",
"www.googleapis.com",
"www.microsoft.com",
"www.office.com",
"www.onedrive.com",
"www.outlook.com",
"www.sway.com",
"www.wunderlist.com",
"www.youtube.com",
"yammer.com",
"yammerusercontent.com"
],
"matching_attributes": [
"domain",
"domain|ip",
"hostname"
],
"name": "List of known Office 365 URLs",
"type": "string",
"version": 20201016
}