Permutations is a mathematical term that relates to the act of arranging multiple attributes into sequences. When looking at DNS permutations, we are looking to identify all possible sequences that relate to the given domain or order to determine possible phishing threats. Detecction and Response teams have seen that when threat actors orchestrate targeted phishing attacks, they will often register domains to appear as legitimate services. Actors will often use this technique in order to create the likes of web traffic diversions, spear-phishing downloads, phishing confidential details or sending nefarious emails to company clients or employees.
This repo looks to identify permutations of Microsoft services.
I welcome the community to add to this list.
Please take care when blocking these domains, whilst I'm sure most (if not all), are not legitimate... there could be some that are legitimate (there are too many for me to individually verify).