Exploring Microsoft Subdomains

reconnaissance enterprise security

SecurityTrails Blog · Apr 10 · SecurityTrails team

Using SecurityTrails to explore subdomains inside popular companies is one of our favorite pastimes: you never know what you will find. And no matter if we are exploring giant agencies or companies, as covered in FBI subdomains and Google subdomains, or small IT companies: you can always find some gems.

Today we are going to take a look at Microsoft.com DNS structure to see what we can find using the SecurityTrails intelligent DNS, WHOIS, and IP database.

How can we get information about Microsoft.com DNS zone?

Click here to perform a search for all Microsoft.com subdomains right now, or follow these steps:

  • Navigate to SecurityTrails
  • Type microsoft.com inside the main search box
  • Start exploring the results

Microsoft subdomains search on SecurityTrails.com

This is what we found so far, the most interesting and cool subdomains for one of the most popular software companies ever:

answers.microsoft.com – The place where Microsoft and their community members answer all your questions regarding their products and services. You will be able to post questions, follow discussions and share your knowledge.

advertising.microsoft.com – At this subdomain Microsoft offers the best way to advertise your product and services using their Bing Ads and Oath ad platforms.

demos.microsoft.com – Area used to create, manage and test demos for MS technologies, product, and services, if you want to test something before purchasing or going live, then this may be your place.

open.microsoft.com – The time where Microsoft was the #1 enemy of Open Source has passed many years ago, now they even support it, find all the valuable open source projects that MS is working on at this area.

azure.microsoft.com – The popular cloud platform is hosted here, from here you will be able to purchase services, and also launch your own virtual machines, scale network stuff, among many other things.

careers.microsoft.com – Dreaming about working at Microsoft? They have all kind of job offers here, find your way to work on Microsoft from this subdomain.

campus.microsoft.com – This is curious subdomain… it is called “campus”, and has a title tag written in Chinese language saying “Microsoft Bing School” along with a colorful main image.

developer.microsoft.com – Resources, documentation, and services for any developer to build any kind of application on any platform.

events.microsoft.com – Interested in attending to MS IT events? Stay up to date with all Microsoft product and services (like Azure, Office, Skype, etc) events close to your area.

privacy.microsoft.com – Knowing the way Microsoft protects their customer information and what they do with the information collected from you is vital, learn everything regarding Microsoft Privacy policy from this subdomain.

stream.microsoft.com – On this subdomain, MS explains and shows their approach to streaming services over their platform that will allow you to create, discover, and share videos securely across your organization.

support.microsoft.com – Guides, topics, questions, and answers, find the best way to reach Technical support for MS related products.

Apart from these, we also found many other subdomains giving a lot of 401 and 403 errors, clearly private user areas shielded by IP allow/deny policies.

  • https://ppespteam.microsoft.com
  • http://licensingonlineservicesactivation.microsoft.com
  • https://msonline.microsoft.com

And another mystery:

c.microsoft.com – A plain black page with a 1×1px image, probably used for tracking.


Are you an IT security researcher? Working on the infosec market? We can help you by providing the best tools for your daily security tasks.

As we did today exploring Microsoft DNS zones, you can do too from your home or at work. Start using SecurityTrails to analyze the information gathered from our API, use it for your own interests, or report it for bug bounty programs on any IT related company

Sign up now for free a SecurityTrails API access to access the full potential of our smart historical WHOIS, DNS, and IP database.