misp-warninglists/lists/microsoft-office365/list.json

340 lines
9.1 KiB
JSON

{
"description": "Office 365 URLs and IP address ranges",
"list": [
"aadrm.com",
"account.activedirectory.windowsazure.com",
"account.live.com",
"account.office.net",
"accounts.accesscontrol.windows.net",
"accounts.google.com",
"acompli.net",
"activation.sls.microsoft.com",
"activity.windows.com",
"ad.atdmt.com",
"adl.windows.com",
"admin.microsoft.com",
"admin.onedrive.com",
"admin.sharepoint.com",
"adminwebservice.microsoftonline.com",
"aia.entrust.net",
"ajax.aspnetcdn.com",
"aka.ms",
"amp.azure.net",
"apc.delve.office.com",
"api.dropboxapi.com",
"api.login.yahoo.com",
"api.meetup.com",
"api.office.com",
"api.passwordreset.microsoftonline.com",
"apis.live.net",
"app.adjust.com",
"app.box.com",
"appex-rf.msn.com",
"appex.bing.com",
"apps.identrust.com",
"appsforoffice.microsoft.com",
"aria.microsoft.com",
"assets-yammer.com",
"assets.onestore.ms",
"attachments.office.net",
"aus.delve.office.com",
"auth.gfx.ms",
"autologon.microsoftazuread-sso.com",
"az416426.vo.msecnd.net",
"az826701.vo.msecnd.net",
"azure-apim.net",
"azureedge.net",
"azurerms.com",
"becws.microsoftonline.com",
"bit.ly",
"blob.core.windows.net",
"broadcast.skype.com",
"by.uservoice.com",
"c.bing.com",
"c.bing.net",
"c.live.com",
"c1.microsoft.com",
"cacert.a.omniroot.com",
"cacert.omniroot.com",
"cacerts.digicert.com",
"can.delve.office.com",
"cdn.odc.officeapps.live.com",
"cdn.office.net",
"cdn.onenote.net",
"cdn.optimizely.com",
"cdn.uci.officeapps.live.com",
"cdnprod.myanalytics.microsoft.com",
"cdp1.public-trust.com",
"cert.int-x3.letsencrypt.org",
"cl2.apple.com",
"click.email.microsoftonline.com",
"clientconfig.microsoftonline-p.net",
"cloudapp.net",
"companymanager.microsoftonline.com",
"compass-ssl.microsoft.com",
"compliance.microsoft.com",
"config.office.com",
"config.office.net",
"connect.facebook.net",
"contentstorage.osi.office.net",
"cortana.ai",
"crl.entrust.net",
"crl.globalsign.com",
"crl.globalsign.net",
"crl.identrust.com",
"crl.microsoft.com",
"crl3.digicert.com",
"crl4.digicert.com",
"d.docs.live.net",
"data.flurry.com",
"dc.services.visualstudio.com",
"delve-gcc.office.com",
"delve.office.com",
"device.login.microsoftonline.com",
"dgps.support.microsoft.com",
"directory.services.live.com",
"docs.live.net",
"docs.microsoft.com",
"ecn.dev.virtualearth.net",
"enterpriseregistration.windows.net",
"entrust.net",
"eur.delve.office.com",
"eus-www.sway-cdn.com",
"eus-www.sway-extensions.com",
"events.data.microsoft.com",
"evintl-aia.verisign.com",
"evintl-crl.verisign.com",
"evintl-ocsp.verisign.com",
"evsecure-aia.verisign.com",
"evsecure-crl.verisign.com",
"evsecure-ocsp.verisign.com",
"excelbingmap.firstpartyapps.oaspapps.com",
"excelcs.officeapps.live.com",
"files.sharepoint.com",
"firstpartyapps.oaspapps.com",
"flow.microsoft.com",
"forms.office.com",
"g.live.com",
"gbr.delve.office.com",
"geotrust.com",
"go.microsoft.com",
"graph.facebook.com",
"graph.microsoft.com",
"graph.windows.net",
"helpshift.com",
"hip.live.com",
"hockeyapp.net",
"home.office.com",
"ind.delve.office.com",
"informationprotection.azure.com",
"informationprotection.hosting.portal.azure.net",
"insertmedia.bing.office.net",
"isrg.trustid.ocsp.identrust.com",
"itunes.apple.com",
"jpn.delve.office.com",
"keydelivery.mediaservices.windows.net",
"kor.delve.office.com",
"lam.delve.office.com",
"localytics.com",
"log.optimizely.com",
"login-us.microsoftonline.com",
"login.live.com",
"login.microsoft.com",
"login.microsoftonline-p.com",
"login.microsoftonline.com",
"login.windows-ppe.net",
"login.windows.net",
"logincert.microsoftonline.com",
"loginex.microsoftonline.com",
"lync.com",
"m.facebook.com",
"mail.google.com",
"mail.protection.outlook.com",
"manage.microsoft.com",
"manage.office.com",
"management.azure.com",
"media.azure.net",
"mem.gfx.ms",
"microsoft.com",
"microsoftonline-p.com",
"microsoftonline.com",
"microsoftstream.com",
"microsoftusercontent.com",
"mlccdn.blob.core.windows.net",
"mlccdnprod.azureedge.net",
"msauth.net",
"msauthimages.net",
"mscrl.microsoft.com",
"msdn.microsoft.com",
"msecnd.net",
"msedge.net",
"msftauth.net",
"msftauthimages.net",
"msftidentity.com",
"msidentity.com",
"msocdn.com",
"mstea.ms",
"myanalytics-gcc.microsoft.com",
"myanalytics.microsoft.com",
"myfiles.sharepoint.com",
"nam.delve.office.com",
"nexus.microsoftonline-p.com",
"nps.onyx.azure.net",
"o15.officeredir.microsoft.com",
"o365weve.com",
"ocos-office365-s2s.msedge.net",
"ocsp.digicert.com",
"ocsp.entrust.net",
"ocsp.globalsign.com",
"ocsp.int-x3.letsencrypt.org",
"ocsp.msocsp.com",
"ocsp.omniroot.com",
"ocsp2.globalsign.com",
"ocspx.digicert.com",
"ocsredir.officeapps.live.com",
"odcsm.officeapps.live.com",
"office.com",
"office.live.com",
"office.net",
"office15client.microsoft.com",
"office365.com",
"officeapps.live.com",
"officecdn.microsoft.com",
"officecdn.microsoft.com.edgesuite.net",
"officeclient.microsoft.com",
"officeimg.vo.msecnd.net",
"officepreviewredir.microsoft.com",
"officeredir.microsoft.com",
"officespeech.platform.bing.com",
"omniroot.com",
"oneclient.sfx.ms",
"onenote.com",
"online.office.com",
"onmicrosoft.com",
"outlook.com",
"outlook.office.com",
"outlook.office365.com",
"outlook.uservoice.com",
"outlookmobile.com",
"partnerservices.getmicrosoftkey.com",
"passwordreset.microsoftonline.com",
"peoplegraph.firstpartyapps.oaspapps.com",
"phonefactor.net",
"platform.linkedin.com",
"play.google.com",
"policykeyservice.dc.ad.msft.net",
"portal.cloudappsecurity.com",
"portal.microsoftonline.com",
"portal.office.com",
"powerapps.com",
"pptcs.officeapps.live.com",
"prod.firstpartyapps.oaspapps.com.akadns.net",
"prod.msocdn.com",
"products.office.com",
"protection.office.com",
"protection.outlook.com",
"provisioningapi.microsoftonline.com",
"public-trust.com",
"r.office.microsoft.com",
"r1.res.office365.com",
"r3.res.office365.com",
"r4.res.office365.com",
"res.delve.office.com",
"roaming.officeapps.live.com",
"s.ytimg.com",
"s1.symcb.com",
"s2.symcb.com",
"sa.symcb.com",
"sd.symcb.com",
"search.production.apac.trafficmanager.net",
"search.production.emea.trafficmanager.net",
"search.production.us.trafficmanager.net",
"secure.aadcdn.microsoftonline-p.com",
"secure.globalsign.com",
"secure.meetup.com",
"secure.skypeassets.com",
"securescore.office.com",
"security.microsoft.com",
"sfbassets.com",
"sharepoint.com",
"sharepointonline.com",
"shellprod.msocdn.com",
"signup.live.com",
"skype.com",
"skypeforbusiness.com",
"smtp.office365.com",
"social.yahooapis.com",
"spoprod-a.akamaihd.net",
"sr.symcb.com",
"sr.symcd.com",
"ssw.live.com",
"staffhub.ms",
"staffhub.office.com",
"staffhub.uservoice.com",
"storage.live.com",
"store.office.com",
"streaming.mediaservices.windows.net",
"su.symcb.com",
"su.symcd.com",
"suite.office.net",
"support.content.office.net",
"support.microsoft.com",
"support.office.com",
"svc.ms",
"sway.com",
"sway.office.com",
"symcb.com",
"symcd.com",
"teams.microsoft.com",
"technet.microsoft.com",
"telemetryservice.firstpartyapps.oaspapps.com",
"templates.office.com",
"templateservice.office.com",
"tenor.com",
"tse1.mm.bing.net",
"uci.officeapps.live.com",
"urlp.sfbassets.com",
"users.storage.live.com",
"vassg142.crl.omniroot.com",
"vassg142.ocsp.omniroot.com",
"verisign.com",
"verisign.net",
"videocontent.osi.office.net",
"videoplayercdn.osi.office.net",
"view.atdmt.com",
"virtualearth.net",
"webshell.suite.office.com",
"wikipedia.firstpartyapps.oaspapps.com",
"wns.windows.com",
"wordcs.officeapps.live.com",
"workplaceanalytics.cdn.office.net",
"workplaceanalytics.office.com",
"wus-firstpartyapps.oaspapps.com",
"wus-www.sway-cdn.com",
"wus-www.sway-extensions.com",
"www.acompli.com",
"www.bing.com",
"www.digicert.com",
"www.dropbox.com",
"www.evernote.com",
"www.google-analytics.com",
"www.googleapis.com",
"www.microsoft.com",
"www.office.com",
"www.onedrive.com",
"www.outlook.com",
"www.sway.com",
"www.youtube.com",
"yammer.com",
"yammerusercontent.com"
],
"matching_attributes": [
"domain",
"domain|ip",
"hostname"
],
"name": "List of known Office 365 URLs",
"type": "string",
"version": 20211028
}