by on February 22, 2021, in

MS Office & Teams: Network Connection Target Hosts

This post lists the internet communication targets of Microsoft Office and Teams. It is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.

The series consists of the following articles:

  • Part 1: explanation of the methodology
  • Part 2 (this article): list of MS Office & Teams communication targets

To be continued…

TL;DR

Microsoft Office talks to 69 hosts and 451 IPs on the internet. List of URLs & details below.

About This Data

What Is This List?

The table below lists the internet hosts the MS Office and Teams applications and processes communicated with in a real environment. For each application, the table shows:

  • Application name
  • Application version(s)
  • Process(es) of the application
  • Number of distinct target IP addresses
  • Names and ports of the target hosts

Where Does the Data Come From?

The data was collected in vast limits’ internal network by uberAgent, our endpoint monitoring and analytics product. The data spans a 30-day time range in early 2021.

The table contains metadata of actual network communications. It is accurate and complete insofar as I did not alter anything. I did, however, remove some internal systems and the results of manual web browsing (or similar). Some hostnames may be specific to our location (Germany).

List of Office & Teams Network Connection Target Hosts

Application App version(s) Process(es) #Target IPs Targets
Microsoft Office 16.0.12527.21378
16.0.12527.21416
16.0.12624.20374
16.0.13127.21062
16.0.13127.21064
16.0.13426.20566
16.0.13530.20038
16.0.13530.20062
16.0.13530.20122
16.0.13530.20132
16.0.13530.20316
16.0.13530.20368
16.0.13530.20376
16.0.13530.20418
16.0.13530.20440
16.0.13628.20128
16.0.13628.20246
16.0.13628.20258
16.0.13628.20274
16.0.13628.20346
EXCEL.EXE
HxTsr.exe
Integrator.exe
OfficeC2RClient.exe
OfficeClickToRun.exe
POWERPNT.EXE
SDXHelper.exe
WINWORD.EXE
msoia.exe
451 a-0020.a-msedge.net:80
a7288ab4bb8141e6bf2c769558148a94.fp.measure.office.com:443
acdc-direct.office.com:443
atm-fp-direct.office.com:443
augloop.office.com:443
autodiscover-s.outlook.com:443
binaries.templates.cdn.office.net:443
browser.pipe.aria.microsoft.com:443
cdn.hubblecontent.osi.office.net:443
cdn.odc.officeapps.live.com:443
cdn.uci.officeapps.live.com:443
clients.config.office.net:443
crl.identrust.com:80
crl3.digicert.com:80
dataservice.protection.outlook.com:443
ecs.office.com:443
enrichment.osi.office.net:443
eur03.dataservice.protection.outlook.com:443
fa000000002.resources.office.net:443
fa000000005.resources.office.net:443
fa000000018.resources.office.net:443
fa000000054.resources.office.net:443
fs.microsoft.com:443
hubblecontent.osi.office.net:443
messaging.office.com:443
metadata.templates.cdn.office.net:443
mobile.pipe.aria.microsoft.com:443
mrodevicemgr.officeapps.live.com:443
nexusrules.officeapps.live.com:443
nleditor.osi.office.net:443
ocps.manage.microsoft.com:443
ocsp.digicert.com:80
ocsp.godaddy.com:80
ocsp.starfieldtech.com:80
ocsp.usertrust.com:80
ocsp.verisign.com:80
ocws.officeapps.live.com:443
odc.officeapps.live.com:443
officecdn.microsoft.com.edgesuite.net:80
officecdn.microsoft.com:80
officeclient.microsoft.com:443
ols.officeapps.live.com:443
oneocsp.microsoft.com:80
outlook.office.com:443
outlook.office365.com:443
outlookmobile-office365-tas.msedge.net:443
ow1.res.office365.com:443
peoplegraph.firstpartyapps.oaspapps.com:443
pptsgs.officeapps.live.com:443
r3.o.lencr.org:80
r4.res.office365.com:443
roaming.officeapps.live.com:443
self.events.data.microsoft.com:443
settings-win.data.microsoft.com:443
shredder.osi.office.net:443
spoprod-a.akamaihd.net:443
status.geotrust.com:80
status.thawte.com:80
store.office.com:443
substrate.office.com:443
support.content.office.net:443
sv.symcd.com:80
syncservice.protection.outlook.com:443
upload.fp.measure.office.com:443
v20.events.data.microsoft.com:443
visio.officeapps.live.com:443
waconafd.officeapps.live.com:443
waconatm.officeapps.live.com:443
wordsgs.officeapps.live.com:443
Microsoft Teams 1.3.00.13565 Teams.exe 40 api.flightproxy.teams.microsoft.com:3478
api.flightproxy.teams.microsoft.com:443
api.microsoftstream.com:443
api.userstore.skype.com:443
browser.pipe.aria.microsoft.com:443
config.teams.microsoft.com:443
df.trap.teams.microsoft.com:443
emea.ng.msg.teams.microsoft.com:443
eu-api.asm.skype.com:443
eu-prod.asyncgw.teams.microsoft.com:443
mobile.pipe.aria.microsoft.com:443
outlook.office.com:443
presence.teams.microsoft.com:443
res-1.cdn.office.net:443
sfeur.loki.delve.office.com:443
statics.teams.cdn.office.net:443
teams.events.data.microsoft.com:443
teams.microsoft.com:443
westeurope.notifications.teams.microsoft.com:443
whiteboard.microsoft.com:443
Microsoft.MicrosoftOfficeHub 18.2008.12711.0 WWAHost.exe 2 browser.pipe.aria.microsoft.com:443
ocsp.digicert.com:80
Office Subscription Licensing Heartbeat 16.0.12527.21416
16.0.13127.21064
16.0.13530.20316
16.0.13530.20376
16.0.13530.20440
16.0.13628.20274
OLicenseHeartbeat.exe 16 activation.sls.microsoft.com:443
ecs.office.com:443
nexusrules.officeapps.live.com:443
ocsp.digicert.com:80
officeclient.microsoft.com:443
ols.officeapps.live.com:443

Previous Article Application Network Connection Monitoring With Splunk & uberAgent