Microsoft is among the most imitated brands globally. Running the company’s popular product and service names, such as LinkedIn, Office365, and Windows, on a subdomains lookup tool, we uncovered 7,900 related subdomains.

An analysis of the subdomains lookup results was done with domain and IP intelligence tools, such as IP Geolocation and Bulk WHOIS Lookup. The insights gained allowed us to answer these questions:

• What top-level domains (TLDs) did the domains mostly use?
• Where are the root domains and subdomains located?
• What words were commonly used in the subdomains?
• Are certain subdomains resolving to malicious IP addresses?

Attributable versus Non-Attributable Subdomains

A total of 399 unique root domains were identified from the 7,900 subdomains lookup results. Only one of them, however, could be publicly attributed to Microsoft. How did we find out? We used WHOIS Lookup to see the email address used by Microsoft to register its domain names. And only one of the 399 root domains use the same email address—casting some doubt on the others’ ownership.

There could be valid reasons for other entities to set up Microsoft-related subdomains. Admittedly, however, some could be used in attacks (e.g., to spoof the brand and make malicious campaigns look more believable). Legitimate subdomains too can be exploited by threat actors if they are left forgotten and unprotected.

Top 10 TLDs

The chart below shows the top 10 TLDs used. In total, they account for 94% of the subdomains. The remaining 6% were distributed across 43 other TLDs.

Subdomain Location

Two data points can be considered when it comes to geographically locating subdomains. First is the registrant country based on a root domain’s WHOIS record although that could also reflect the location of the registrar or privacy protection service used by the domain owner.

IP Geolocation, on the other hand, pinpoints the geographical location of the IP address the subdomain name resolves to. IP resolutions can be identified by tools like Bulk IP Geolocation Lookup, which found 1,460 unique IP addresses in this particular case.

The table below shows the top 10 registrant countries and the top 10 IP locations of the subdomains. The U.S. topped the list of registrant countries, which is not far from its IP geolocation ranking. Apart from the U.S., Canada, and France appeared on both lists as well.

Commonly Used Text Strings

The text string “com” appeared prominently not just as a TLD but also in other layers of the subdomains, perhaps to make people believe that their TLD is .com and have them disregard their remaining parts. A few examples are highlighted in red in the screenshot below.

Aside from “com,” other words that repeatedly appeared in the subdomains include “online,” “login,” “net,” “microsoftonline,” “microsoft,” “windows,” “office,” “hostmaster,” and “duckdns.” The chart below shows the number of times these text strings appeared.

Microsoft-Related Subdomains Resolving to Malicious IP Addresses

Several IP addresses were associated with multiple subdomains. Those that had more than 35 connected subdomains were checked on AbuseIPDB.

These IP addresses were reported for different malicious activities, including phishing, spamming, fraudulent orders, brute-force attacks, and port scanning. A total of 996 subdomains connect to these IP addresses, making them a high priority for security teams.

When it comes to the digital world, imitation is not the highest form of flattery. It is dangerous and could result in cybercrime. This short study on the subdomains lookup results for Microsoft and its products or services aims to show the importance of monitoring subdomains as part of an enterprise’s domain attack surface. What’s more, these subdomains are not only part of Microsoft’s attack surface, but that of every user.