b.c2r.ts.cdn.office.net i640.c2rx being flagged as Malware / Malicious by Meraki AMP

Question

I am receiving messages from Meraki's Advanced Malware Protection (AMP) service about users downloading i640.c2rx

It is being flagged as Malware / Malicious

http://b.c2r.ts.cdn.office.net/pr/4456550f6-4r5-34-4bb53-34c5yw45vv43/Office/Data/16.0.15601.20088/i640.c2rx Content Delivery Networks (CDNs)

Everything about this says it is a Microsoft update.

Answer 1

Hi @IngallsPW1

> Everything about this says it is a Microsoft update.

Could you please tell us which version of Office are you running?

About the URL you provided, I do not find any links directly to explain it. But in my opinion, it is related to Office, and most likely an Office update.

Here is an article "Office 365 URLs and IP address ranges" lists the URLs about CDNs.
A CDN is a geographically distributed network, users can access it to get Office installation package or download the Office updates.
From the article "Update history for Microsoft 365 Apps (listed by date)", I find the latest version of Microsoft 365 Apps with Current Channel is Version 2208 (Build 15601.20088).

Hope the information could be helpful.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---