{
  "description": "Office 365 URLs and IP address ranges used for their attack simulator in Office 365 Threat Intelligence",
  "list": [
    "52.168.52.134",
    "portal.docdeliveryapp.com",
    "portal.docdeliveryapp.net",
    "portal.docstoreinternal.com",
    "portal.hardwarecheck.net",
    "portal.hrsupportint.com",
    "portal.payrolltooling.com",
    "portal.payrolltooling.net",
    "portal.prizegiveaway.net",
    "portal.prizesforall.com",
    "securescore-user-prod.cloudapp.net",
    "www.attemplate.com",
    "www.bankmenia.com",
    "www.bankmenia.de",
    "www.bankmenia.es",
    "www.bankmenia.fr",
    "www.bankmenia.it",
    "www.bankmenia.org",
    "www.banknown.de",
    "www.banknown.es",
    "www.banknown.fr",
    "www.banknown.it",
    "www.banknown.org",
    "www.browsersch.com",
    "www.browsersch.de",
    "www.browsersch.es",
    "www.browsersch.fr",
    "www.browsersch.it",
    "www.browsersch.org",
    "www.docdeliveryapp.com",
    "www.docdeliveryapp.net",
    "www.docstoreinternal.com",
    "www.docstoreinternal.net",
    "www.doctorican.de",
    "www.doctorican.es",
    "www.doctorican.fr",
    "www.doctorican.it",
    "www.doctorican.org",
    "www.doctrical.com",
    "www.doctrical.de",
    "www.doctrical.es",
    "www.doctrical.fr",
    "www.doctrical.it",
    "www.doctrical.org",
    "www.doctricant.com",
    "www.doctrings.com",
    "www.doctrings.de",
    "www.doctrings.es",
    "www.doctrings.fr",
    "www.doctrings.it",
    "www.doctrings.org",
    "www.exportants.com",
    "www.exportants.de",
    "www.exportants.es",
    "www.exportants.fr",
    "www.exportants.it",
    "www.exportants.org",
    "www.financerta.com",
    "www.financerta.de",
    "www.financerta.es",
    "www.financerta.fr",
    "www.financerta.it",
    "www.financerta.org",
    "www.financerts.com",
    "www.financerts.de",
    "www.financerts.es",
    "www.financerts.fr",
    "www.financerts.it",
    "www.financerts.org",
    "www.hardwarecheck.net",
    "www.hrsupportint.com",
    "www.mcsharepoint.com",
    "www.mesharepoint.com",
    "www.officence.com",
    "www.officenced.com",
    "www.officences.com",
    "www.officentry.com",
    "www.officested.com",
    "www.passwordle.de",
    "www.passwordle.fr",
    "www.passwordle.it",
    "www.passwordle.org",
    "www.payrolltooling.com",
    "www.payrolltooling.net",
    "www.prizeably.com",
    "www.prizeably.de",
    "www.prizeably.es",
    "www.prizeably.fr",
    "www.prizeably.it",
    "www.prizeably.org",
    "www.prizegiveaway.net",
    "www.prizegives.com",
    "www.prizemons.com",
    "www.prizesforall.com",
    "www.prizewel.com",
    "www.prizewings.com",
    "www.resetts.de",
    "www.resetts.es",
    "www.resetts.fr",
    "www.resetts.it",
    "www.resetts.org",
    "www.salarytoolint.com",
    "www.salarytoolint.net",
    "www.securembly.com",
    "www.securembly.de",
    "www.securembly.es",
    "www.securembly.fr",
    "www.securembly.it",
    "www.securembly.org",
    "www.securetta.de",
    "www.securetta.es",
    "www.securetta.fr",
    "www.securetta.it",
    "www.shareholds.com",
    "www.sharepointen.com",
    "www.sharepointin.com",
    "www.sharepointle.com",
    "www.sharesbyte.com",
    "www.sharession.com",
    "www.sharestion.com",
    "www.supportin.de",
    "www.supportin.es",
    "www.supportin.fr",
    "www.supportin.it",
    "www.supportres.de",
    "www.supportres.es",
    "www.supportres.fr",
    "www.supportres.it",
    "www.supportres.org",
    "www.techidal.com",
    "www.techidal.de",
    "www.techidal.fr",
    "www.techidal.it",
    "www.techniel.de",
    "www.techniel.es",
    "www.techniel.fr",
    "www.techniel.it",
    "www.templateau.com",
    "www.templatent.com",
    "www.templatern.com",
    "www.windocyte.com"
  ],
  "matching_attributes": [
    "ip-src",
    "ip-dst",
    "domain",
    "domain|ip",
    "hostname",
    "url"
  ],
  "name": "List of known Office 365 Attack Simulator used for phishing awareness campaigns",
  "type": "substring",
  "version": 20260405
}