ScanMalware.com
Known benign platformlowbenign

Microsoft Attack Simulation Training

family: microsoft-attack-simulator

Microsoft Defender for O365 "Attack simulation training" — Microsoft-owned decoy domains serving Microsoft-branded login pages for phishing-awareness testing. Benign; tracked for inventory only. Whole fleet shares one TLS cert (issuer Microsoft Corporation, CN www.attemplate.com, 131 SANs). Forward-collected via the tls_certificates trigger + security-analyzer cert classifier.

Anchors

SMQL queryrun
url:*/login?id=* AND nameserver:*azure-dns*

Provenance

Added: 2026-06-24 21:12
References:

Sightings (19)

HostScanScriptMatchWhen
cde-prod-eastus.azurewebsites.netbb87bf08…—cert2026-07-25 23:46
geoip-prod-b-app.azurewebsites.net8c940e54…—cert2026-07-24 02:33
mdnotificationservice.azurewebsites.nete0314a12…—cert2026-07-19 20:32
commerce.bing.coma545bf5a…—cert2026-07-18 04:38
cwap-nam1-runtime.routing.msappproxy.neta58af59a…—cert2026-07-13 19:47
documentationportal.azurewebsites.netdf04b45d…—cert2026-07-09 22:19
1-6848451-6116700217344-576.rt.yammer.com9e4a1871…—cert2026-07-09 19:04
trackingpixelprod.azurewebsites.netfc8c9efd…—cert2026-07-09 14:56
pwmgr-gateway-cohfl.msappproxy.netf6011318…—cert2026-07-09 06:32
bfsintranetlive01.azurewebsites.net969079eb…—cert2026-07-08 16:19
ingress.eastus.arcdataservices.com0141e0d1…—cert2026-07-05 10:24
api.yammer.com725f7916…—cert2026-07-03 06:39
vm56-proxy-appproxy-cus-dsm02p-6.connector.msappproxy.net2ddfd31c…—cert2026-07-02 02:13
1-255619-1569808606-388.rt.yammer.comc39d859e…—cert2026-06-27 08:45
vm36-proxy-appproxy-eus-mnz01p-3.connector.msappproxy.netc458ff1c…—cert2026-06-26 16:00
vm94-proxy-appproxy-eus-mnz01p-3.connector.msappproxy.netfa3d9cb5…—cert2026-06-25 23:00
attemplate.com58f80acd…—cert2026-06-25 07:59
docstoreinternal.comaeadd13b…—query2026-06-24 21:12
resetts.it494709a5…—query2026-06-24 21:12