Home / Industry

What Subdomains Lookup Revealed About Thousands of Microsoft-Related Subdomains

Microsoft is among the most imitated brands globally. Running the company's popular product and service names, such as LinkedIn, Office365, and Windows, on a subdomains lookup tool, we uncovered 7,900 related subdomains.

An analysis of the subdomains lookup results was done with domain and IP intelligence tools, such as IP Geolocation and Bulk WHOIS Lookup. The insights gained allowed us to answer these questions:

  • What top-level domains (TLDs) did the domains mostly use?
  • Where are the root domains and subdomains located?
  • What words were commonly used in the subdomains?
  • Are certain subdomains resolving to malicious IP addresses?

Attributable versus Non-Attributable Subdomains

A total of 399 unique root domains were identified from the 7,900 subdomains lookup results. Only one of them, however, could be publicly attributed to Microsoft. How did we find out? We used WHOIS Lookup to see the email address used by Microsoft to register its domain names. And only one of the 399 root domains use the same email address — casting some doubt on the others' ownership.

There could be valid reasons for other entities to set up Microsoft-related subdomains. Admittedly, however, some could be used in attacks (e.g., to spoof the brand and make malicious campaigns look more believable). Legitimate subdomains too can be exploited by threat actors if they are left forgotten and unprotected.

Top 10 TLDs

The chart below shows the top 10 TLDs used. In total, they account for 94% of the subdomains. The remaining 6% were distributed across 43 other TLDs.

Subdomain Location

Two data points can be considered when it comes to geographically locating subdomains. First is the registrant country based on a root domain's WHOIS record although that could also reflect the location of the registrar or privacy protection service used by the domain owner.

IP Geolocation, on the other hand, pinpoints the geographical location of the IP address the subdomain name resolves to. IP resolutions can be identified by tools like Bulk IP Geolocation Lookup, which found 1,460 unique IP addresses in this particular case.

The table below shows the top 10 registrant countries and the top 10 IP locations of the subdomains. The U.S. topped the list of registrant countries, which is not far from its IP geolocation ranking. Apart from the U.S., Canada, and France appeared on both lists as well.

RankTop Registrant CountriesTop IP Locations
1U.S.France
2RussiaU.S.
3GermanyPanama
4NetherlandsIndia
5CanadaChina
6FranceCanada
7AustraliaTurkey
8IrelandSpain
9British Virgin IslandsIndonesia
10U.K.Japan

Commonly Used Text Strings

The text string "com" appeared prominently not just as a TLD but also in other layers of the subdomains, perhaps to make people believe that their TLD is .com and have them disregard their remaining parts. A few examples are highlighted in red in the screenshot below.

Aside from "com," other words that repeatedly appeared in the subdomains include "online," "login," "net," "microsoftonline," "microsoft," "windows," "office," "hostmaster," and "duckdns." The chart below shows the number of times these text strings appeared.

Microsoft-Related Subdomains Resolving to Malicious IP Addresses

Several IP addresses were associated with multiple subdomains. Those that had more than 35 connected subdomains were checked on AbuseIPDB.

IP AddressNumber of Connected Microsoft-Related SubdomainsNumber of Times Reported on AbuseIPDBIP Geolocation
23[.]227[.]197[.]754031U.S.
178[.]159[.]36[.]1393762Russia
192[.]169[.]69[.]2511828U.S.
185[.]206[.]180[.]130629Germany
204[.]11[.]56[.]4837110British Virgin Islands

These IP addresses were reported for different malicious activities, including phishing, spamming, fraudulent orders, brute-force attacks, and port scanning. A total of 996 subdomains connect to these IP addresses, making them a high priority for security teams.


When it comes to the digital world, imitation is not the highest form of flattery. It is dangerous and could result in cybercrime. This short study on the subdomains lookup results for Microsoft and its products or services aims to show the importance of monitoring subdomains as part of an enterprise's domain attack surface. What's more, these subdomains are not only part of Microsoft's attack surface, but that of every user.

By WhoisXML API, A Domain Research, Whois, DNS, and Threat Intelligence API and Data Provider – Whois API, Inc. (whoisxmlapi) is a big data and API company that provides domain research & monitoring, Whois, DNS, IP, and threat intelligence API, data and tools to a variety of industries.  Visit Page

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Related

Topics

DNS Security

Sponsored byAfilias

Cybercrime

Sponsored byThreat Intelligence Platform

Brand Protection

Sponsored byAppdetex

New TLDs

Sponsored byAfilias

Domain Names

Sponsored byVerisign

IP Addressing

Sponsored byIPv4.Global

Cybersecurity

Sponsored byVerisign

Whois

Sponsored byWhoisXML API