Scammer Abuses Microsoft 365 Tenants, Relaying Through Proofpoint Servers to Deliver Spam Campaigns

Share with your network!

Key Findings

  • In March, Proofpoint researchers identified spam campaigns being relayed through a small number of Proofpoint customers’ email infrastructure by sending spam from Microsoft 365 tenants
  • All analyses indicate this activity was conducted by one spam actor, whose activity we do not attribute to a known entity
  • The root cause is a modifiable email routing configuration feature on Proofpoint servers to allow relay of organisations’ outbound messages from Microsoft 365 tenants, but without specifying which M365 tenants to allow
  • To resolve the issue, Proofpoint implemented a streamlined administrative interface for customers to specify which M365 tenants are allowed to relay, with all other M365 tenants denied by default
  • Any email infrastructure that offers this email routing configuration feature can be abused by spammers
  • Proofpoint Essentials customers are not affected, as configuration settings are already set that prevent unauthorised relay abuse
  • This issue did not expose any Proofpoint customer data, and no customer experienced any data loss as a result
  • We are sharing what we know about these campaigns to help others mitigate this issue and prevent further unauthorised abuse, as it is not unique to Proofpoint

Abusing an Outbound Email Relay Configuration to Conduct Spam Campaigns

In March 2024, Proofpoint observed spam campaigns being relayed from Microsoft 365 tenants through several Proofpoint enterprise customers’ email infrastructures, targeting users of free email providers such as Yahoo, Gmail, and GMX. The commonality shared between all the customers whose email infrastructures were being abused was a modifiable configuration setting that allowed outbound messages to be relayed from Microsoft 365. Spammers can therefore abuse any email infrastructure that allows messages to be relayed from email hosting services through their infrastructure.

This specific email routing configuration abused by the spammer allowed outbound messages to be sent from a customer’s Microsoft 365 tenant for relay through their infrastructure, but it did not limit the Microsoft tenants allowed to relay.

The spammer, whose activity we do not attribute to a known entity, controlled Microsoft 365 tenants that used random strings of letters and numbers, such as 23gdfs56gsd.onmicrosoft.com, for some of the spam messages. Some of the spam made no attempt to disguise the sender address and used the oddly named Microsoft tenant names as the sending domain. Some of spam used the onmicrosoft.com tenant names in the “from” field and other spam messages spoofed the sender email, not all of which were successfully delivered. Interestingly, while the spammer tried this against several Proofpoint infrastructures, some accepted the messages for relay while others rejected the messages.

The spammer spoofed the RFC822 “from” header but could not spoof the RFC821 envelope sender address. The spammer used a rotating series of leased virtual private servers (VPS) from several providers, using many different IP addresses to initiate quick bursts of thousands of messages at a time from their SMTP servers, sent to Microsoft 365 to be relayed to Proofpoint-hosted customer servers.

Microsoft 365 accepted these spoofed messages and sent them to these customers’ email infrastructures to be relayed. When customer domains were spoofed while relaying through the matching customer’s email infrastructure, DKIM signing was also applied as the messages transited through the Proofpoint infrastructure, making the spam messages more deliverable.

As many of the tenants being abused by the spammer are still active as of writing, we have implemented several measures to prevent unauthorised relay through Proofpoint servers to keep our customers protected.

Taking Action to Notify and Protect Our Customers

Proofpoint quickly mobilised a cross-functional task force to identify and contact all customers that had an at-risk configuration to help them change their configuration settings, prioritising those whose infrastructures were actively being abused. We also developed a process to ensure new customers are configured to prevent relay abuse.

We made the configuration process as easy and straightforward as possible for all customers with this specific relay setting: we provided clear instructions in both written and video formats, developed an FAQ and set up a dedicated page in our customer Community portal, issued in-product alerts, assisted customers over video meetings, and explained what could happen if the configuration was not correct.

Next, Proofpoint Threat Research identified the early warning signs of the spammer’s activity as it set up and tested new relays. By identifying the early stages of deliverability testing that preceded spam campaigns, we were able to get ahead of the spammer’s activity and proactively work with customers who could be targeted next.

We found that for some customers whose configurations were set to never block outbound messages, it was challenging to stop all the outbound spam campaigns. We therefore contacted those customers to help them change those settings as well, which further improved the effectiveness of our spam detection engines to stop the outbound relay spam campaigns based on message content. As we started to block the spammer’s activity, the spammer accelerated its testing and moved quickly to other customers. We established a continuous process of identifying the customers affected each day, re-prioritising outreach to fix configurations.

Collaborating with the Wider Security Community

We encourage security researchers to contact vendors and service providers, such as Proofpoint, to report issues and share findings. We also shared our findings about this relay abuse with other email infrastructure providers to help them protect their customers as well. Even when the security service provider is already aware and working on a solution, an outside perspective is helpful to validate and test solutions.

During this process, we greatly appreciated the support and information provided to us by the wider security and service provider community. We received helpful reporting from several third parties, including multiple service providers and Guardio Labs, underlining the value of maintaining good technical working relationships across the industry. Guardio Labs notably provided us additional technical information that complemented our research, allowing us to more accurately reproduce the relay setup and validate that changes we instructed our customers to make were effective in stopping the relay abuse.

Key Learnings

While our response was swift once we identified the spammer’s relay abuse, quickly engaging multiple teams to prioritise remediation and support impacted customers, we are always looking to further improve our processes to reduce potential risks.

Offering relay configuration options to customers is valuable, and usability is equally important—the email infrastructure provider should ensure controls are intuitive and clearly explain the significance of setting them correctly.

We encourage email service providers to limit the power of free trial and newly created unverified tenants to send large volume outbound email campaigns, especially when relayed through other providers. Email service providers should also prevent their customer tenants from sending outbound messages that spoof a domain for which they do not have proven ownership. Curbing abuse at the source of message sending is the most effective way to reduce spam.

We also encourage virtual private server providers to limit their customers’ ability to send mass bulk spam campaigns from SMTP servers hosted on their infrastructure.

Lastly, identifying and stopping the relay abuse discussed in this blog underscores how the cybersecurity ecosystem at large benefits from collaboration and open communication across threat research and detection teams globally. Across the public and private sectors, across industries and geographies around the world, we work together to keep us all safe. We respect and value the collective contributions, open dialogue, and different insights we all offer in order keep our communities protected.

Indicators of Compromise

Below is a list of the Microsoft tenants that we have observed being abused by the spammer. As of the publication of this blog, many are still active. We have implemented several measures to prevent unauthorised relay through Proofpoint servers to keep our customers protected.

0h1[.]onmicrosoft[.]com

0reh05idlwaswiq[.]onmicrosoft[.]com

0roKxveKWDq5[.]onmicrosoft[.]com

0z8pg1vhlwny48z[.]onmicrosoft[.]com

1m2htrxg3po7e9wg2[.]onmicrosoft[.]com

23gdfs56gsd[.]onmicrosoft[.]com

2cxz1f56s[.]onmicrosoft[.]com

2db499nsln9j7w1o9a6zmu[.]onmicrosoft[.]com

2g31x56gd[.]onmicrosoft[.]com

379vojhrx0ohzotf5otdoycqc9b[.]onmicrosoft[.]com

3ihogunicotireph[.]onmicrosoft[.]com

3o2d6n4gp1xl1jo2d4ayeeogjdfw[.]onmicrosoft[.]com

4eri3reraqib3tet[.]onmicrosoft[.]com

4fi0[.]onmicrosoft[.]com

4h8gf5h4gd8y[.]onmicrosoft[.]com

4ritajubrefica[.]onmicrosoft[.]com

58frghyqsz[.]onmicrosoft[.]com

5hbnbrcdds[.]onmicrosoft[.]com

5lwiroplbrusldit[.]onmicrosoft[.]com

6ba4a90bnmp9xsqa[.]onmicrosoft[.]com

6bnfdvbdf[.]onmicrosoft[.]com

6pd6lkrsp94ma1sglb146[.]onmicrosoft[.]com

6pq[.]onmicrosoft[.]com

6zc8sx[.]onmicrosoft[.]com

785fvinrs4et5b2cqwt9xc[.]onmicrosoft[.]com

a9mnqbsvmfmre[.]onmicrosoft[.]com

aaahyamartiniilii[.]onmicrosoft[.]com

AAAUS21[.]onmicrosoft[.]com

aalimm[.]onmicrosoft[.]com

aarasdtyj[.]onmicrosoft[.]com

abab01[.]onmicrosoft[.]com

abandonedlittleand[.]onmicrosoft[.]com

Abbildhpfpmptunphe[.]onmicrosoft[.]com

academiaedu[.]onmicrosoft[.]com

accedubz[.]onmicrosoft[.]com

adfgghdfbgjgsdf[.]onmicrosoft[.]com

adncolkilsopmaq[.]onmicrosoft[.]com

adorableamazon81[.]onmicrosoft[.]com

aebx[.]onmicrosoft[.]com

Afconziyech[.]onmicrosoft[.]com

afdagfdasgdsgasf[.]onmicrosoft[.]com

afqweiufa[.]onmicrosoft[.]com

africatobeonaws[.]onmicrosoft[.]com

afyutqgyt[.]onmicrosoft[.]com

ahidosnait32ta[.]onmicrosoft[.]com

akha[.]onmicrosoft[.]com

akhir22[.]onmicrosoft[.]com

alahalmostan[.]onmicrosoft[.]com

alawasa[.]onmicrosoft[.]com

algammou[.]onmicrosoft[.]com

almotanabi[.]onmicrosoft[.]com

alumavaxklczryzdlzr[.]onmicrosoft[.]com

amana770[.]onmicrosoft[.]com

amimer2[.]onmicrosoft[.]com

AndrWalsh[.]onmicrosoft[.]com

angelicoo[.]onmicrosoft[.]com

antlisa[.]onmicrosoft[.]com

antonya777[.]onmicrosoft[.]com

artogrulghazi[.]onmicrosoft[.]com

asdfghjukil[.]onmicrosoft[.]com

asgarskk[.]onmicrosoft[.]com

asxzashdf[.]onmicrosoft[.]com

aty6reynoja[.]onmicrosoft[.]com

avericraig31kayla[.]onmicrosoft[.]com

avts9yq7f[.]onmicrosoft[.]com

ayfgswyhde[.]onmicrosoft[.]com

ayoubel[.]onmicrosoft[.]com

ayoubserghini[.]onmicrosoft[.]com

azalwendo[.]onmicrosoft[.]com

azasarghimnhgt[.]onmicrosoft[.]com

babonutlbekak0[.]onmicrosoft[.]com

bamrong[.]onmicrosoft[.]com

bamronga[.]onmicrosoft[.]com

bandalignano[.]onmicrosoft[.]com

BansheeSystems[.]onmicrosoft[.]com

Barondialhxixa[.]onmicrosoft[.]com

barteman[.]onmicrosoft[.]com

batmanlight[.]onmicrosoft[.]com

Battisteljobmh[.]onmicrosoft[.]com

bawrehiqlml[.]onmicrosoft[.]com

bbhlibraryd[.]onmicrosoft[.]com

beholdendgepoasiafqg[.]onmicrosoft[.]com

BenghaziPolanda[.]onmicrosoft[.]com

berga015[.]onmicrosoft[.]com

bernadno[.]onmicrosoft[.]com

bewoforoqez[.]onmicrosoft[.]com

bgty015q[.]onmicrosoft[.]com

biblicalwott[.]onmicrosoft[.]com

bibozi2[.]onmicrosoft[.]com

blackboxcmyztkdplwxh[.]onmicrosoft[.]com

blackbun[.]onmicrosoft[.]com

blancom[.]onmicrosoft[.]com

blever3490frlbh[.]onmicrosoft[.]com

bolmendo[.]onmicrosoft[.]com

bonjourvistagqhgq[.]onmicrosoft[.]com

brablconlw[.]onmicrosoft[.]com

bridgemarynet[.]onmicrosoft[.]com

BrikidialiHadakg[.]onmicrosoft[.]com

Brittany96Howell[.]onmicrosoft[.]com

bsarghimnhgt[.]onmicrosoft[.]com

bsevtat[.]onmicrosoft[.]com

bsleopoldsburgbe[.]onmicrosoft[.]com

Bugiadabzefipooluct[.]onmicrosoft[.]com

buwvbjffzn[.]onmicrosoft[.]com

bxcvugsduyfg[.]onmicrosoft[.]com

bzalwendo[.]onmicrosoft[.]com

bzsigmond[.]onmicrosoft[.]com

bzxcubgsudfygs[.]onmicrosoft[.]com

c3u2g5w67[.]onmicrosoft[.]com

cabejantszcpod[.]onmicrosoft[.]com

Car9olenger[.]onmicrosoft[.]com

ccwswrs[.]onmicrosoft[.]com

cdnpavianet[.]onmicrosoft[.]com

Centralofices[.]onmicrosoft[.]com

cfbabhnbc[.]onmicrosoft[.]com

cfcnglns65p07a512l[.]onmicrosoft[.]com

cfroou32qar[.]onmicrosoft[.]com

chcsmez[.]onmicrosoft[.]com

chihabafilal323@gmail[.]com

chiwrlx5x4gastukl[.]onmicrosoft[.]com

chopevemucr[.]onmicrosoft[.]com

citlallicvkbswzeiosks[.]onmicrosoft[.]com

civiluH1Ncpumuan[.]onmicrosoft[.]com

clementy618[.]onmicrosoft[.]com

clemon108[.]onmicrosoft[.]com

cliejgred[.]onmicrosoft[.]com

cmchmaristascl[.]onmicrosoft[.]com

colombiaancestral[.]onmicrosoft[.]com

comntrewafhdfdgklop[.]onmicrosoft[.]com

costamarsh[.]onmicrosoft[.]com

counde[.]onmicrosoft[.]com

croissantfrech[.]onmicrosoft[.]com

cshhg[.]onmicrosoft[.]com

cuhwbak[.]onmicrosoft[.]com

custowawrav[.]onmicrosoft[.]com

cuxicadoweb[.]onmicrosoft[.]com

cxvgsdgcvsdxvdbcxbc[.]onmicrosoft[.]com

czarbok[.]onmicrosoft[.]com

czoplito[.]onmicrosoft[.]com

d1a7f1g4hr[.]onmicrosoft[.]com

dahmadbotfonast[.]onmicrosoft[.]com

dawriespani[.]onmicrosoft[.]com

dcbatfdgvcj[.]onmicrosoft[.]com

dctln[.]onmicrosoft[.]com

decrninja[.]onmicrosoft[.]com

denmarkmenshed[.]onmicrosoft[.]com

dffsuighth[.]onmicrosoft[.]com

dfgfdgsdFshdfjdskdj[.]onmicrosoft[.]com

dfghjftykiuy[.]onmicrosoft[.]com

dfgjswediusd[.]onmicrosoft[.]com

dfjiduhfuiidfdiifhdofijfoi[.]onmicrosoft[.]com

dfkgeifgquyfg[.]onmicrosoft[.]com

dgfvcbxcgzcbfchfcvbcbcxfnb[.]onmicrosoft[.]com

dghdfgsdgfdg[.]onmicrosoft[.]com

dgvcxbfdxjbnvcxnfdzhv[.]onmicrosoft[.]com

dgvkusdlgsidg[.]onmicrosoft[.]com

dhfcvbdzgvbbdsfdvxcvdxcbxcbm[.]onmicrosoft[.]com

dhfgweyftwuqaresd[.]onmicrosoft[.]com

dhgfjjdsgjskdgdjsgsd[.]onmicrosoft[.]com

dhim70dz9zkcytkrngjod95g2qqw[.]onmicrosoft[.]com

dhjfcvydc[.]onmicrosoft[.]com

didiernsf[.]onmicrosoft[.]com

dihupraspu7pugo[.]onmicrosoft[.]com

dinzashdf[.]onmicrosoft[.]com

ditlaviovy[.]onmicrosoft[.]com

djawdbawd[.]onmicrosoft[.]com

dkttc[.]onmicrosoft[.]com

dlmsjnhkji[.]onmicrosoft[.]com

dnghkc[.]onmicrosoft[.]com

domnef[.]onmicrosoft[.]com

doublon7[.]onmicrosoft[.]com

dqroenztuk19z30do97vs[.]onmicrosoft[.]com

draglnlfrost[.]onmicrosoft[.]com

drgcsdfgxcvsfxcfdxg[.]onmicrosoft[.]com

druqaqiphehix[.]onmicrosoft[.]com

dsastxdd[.]onmicrosoft[.]com

dsghfjsajsdgkjsd[.]onmicrosoft[.]com

dshhg[.]onmicrosoft[.]com

dsumed[.]onmicrosoft[.]com

DTRDxRTcRDCDRvUYf[.]onmicrosoft[.]com

dughsjkdhu[.]onmicrosoft[.]com

dxgrydzsryy[.]onmicrosoft[.]com

dxhgdghxdgdshbvcnxfhd[.]onmicrosoft[.]com

dzagrebj[.]onmicrosoft[.]com

dzoplito[.]onmicrosoft[.]com

e2t1ubd1z5[.]onmicrosoft[.]com

e5133a21vnlao5vf[.]onmicrosoft[.]com

echvmtw[.]onmicrosoft[.]com

edc2015[.]onmicrosoft[.]com

edenlidichanlfkkrmcukfte[.]onmicrosoft[.]com

edu[.]echvmtw[.]onmicrosoft[.]com

edu[.]lioe[.]onmicrosoft[.]com

educationapple96[.]onmicrosoft[.]com

EDUVAERSD[.]onmicrosoft[.]com

eebabhnbc[.]onmicrosoft[.]com

eerasdtyj[.]onmicrosoft[.]com

efjhdshfe[.]onmicrosoft[.]com

EFLEETSYSTEMS[.]onmicrosoft[.]com

efuiwefhjhj[.]onmicrosoft[.]com

egdgsadgdxvdcvfcbchgkgf[.]onmicrosoft[.]com

egressyeu[.]onmicrosoft[.]com

elevenom[.]onmicrosoft[.]com

elisitalianesta[.]onmicrosoft[.]com

elllaksnj[.]onmicrosoft[.]com

emailcontact132[.]onmicrosoft[.]com

enjoylifemanimbdqylkposv[.]onmicrosoft[.]com

Erdwalzehyflp[.]onmicrosoft[.]com

ergdbvvf[.]onmicrosoft[.]com

erwfiuhkjrewiuew[.]onmicrosoft[.]com

esdgrhfl[.]onmicrosoft[.]com

everyonecanhelp[.]onmicrosoft[.]com

EYYytCYTYuyfyuDTRD[.]onmicrosoft[.]com

f1sd5a4f[.]onmicrosoft[.]com

f4h5gf56gf[.]onmicrosoft[.]com

FacultySSX[.]onmicrosoft[.]com

fadolii[.]onmicrosoft[.]com

fadwujahdjdfffgkgg[.]onmicrosoft[.]com

fagomlvache[.]onmicrosoft[.]com

farahmsw56956[.]onmicrosoft[.]com

farocapital365[.]onmicrosoft[.]com

Farpmdldasa[.]onmicrosoft[.]com

fas83[.]onmicrosoft[.]com

fasmetonm[.]onmicrosoft[.]com

fastarvqutz[.]onmicrosoft[.]com

fcbvbnxchngfjgvnbxcbz[.]onmicrosoft[.]com

fdgcvbxcdcbcgxcbdfxvc[.]onmicrosoft[.]com

fdgfdgdgsdgdsf[.]onmicrosoft[.]com

fdghfbszgxcgdhvcbfsdgcb[.]onmicrosoft[.]com

fdhdgdgsgfhfjgfjopmknjubh[.]onmicrosoft[.]com

fdhdsgsdhfgfjdsdfs[.]onmicrosoft[.]com

fdhfdhsdgbcsdgsfdgdfcbsdfg[.]onmicrosoft[.]com

feadsges[.]onmicrosoft[.]com

felnder[.]onmicrosoft[.]com

fenzd[.]onmicrosoft[.]com

ferione[.]onmicrosoft[.]com

fexoswetldrlwlpadusa[.]onmicrosoft[.]com

fgbgfbtsbg[.]onmicrosoft[.]com

fgbhghtrghtrhgrthrthtrhrt[.]onmicrosoft[.]com

fgdfgdsg454dfdcf45[.]onmicrosoft[.]com

fgdsjfjkgdsJKAG[.]onmicrosoft[.]com

fghdfcvbdvxvxgvcnchbvcnfdn[.]onmicrosoft[.]com

fghfdghfdfhvbrfdgcfdhfv[.]onmicrosoft[.]com

fghfhd54654tfghgf[.]onmicrosoft[.]com

fgjdrzhsfdhfdldg[.]onmicrosoft[.]com

fhcrecycled[.]onmicrosoft[.]com

fhdgdghdskgjgsfs[.]onmicrosoft[.]com

fidelitiasom[.]onmicrosoft[.]com

fiscalizadoorcopampa[.]onmicrosoft[.]com

fitolrti[.]onmicrosoft[.]com

fiv3cake5riste[.]onmicrosoft[.]com

frakutrlhlp[.]onmicrosoft[.]com

FrantisekVesely[.]onmicrosoft[.]com

frend265[.]onmicrosoft[.]com

freslzuphly[.]onmicrosoft[.]com

frtotajhdjjgkjdssa[.]onmicrosoft[.]com

fsiwatyahs[.]onmicrosoft[.]com

fuaqgfjyagfuy[.]onmicrosoft[.]com

fukcujckckckc[.]onmicrosoft[.]com

furgeson862[.]onmicrosoft[.]com

fvoopk410a[.]onmicrosoft[.]com

g231ds564gs[.]onmicrosoft[.]com

gafaacat[.]onmicrosoft[.]com

gaitasineticaRB[.]onmicrosoft[.]com

Galomandationd[.]onmicrosoft[.]com

ganeshhimal2[.]onmicrosoft[.]com

gau08[.]onmicrosoft[.]com

gcfgsqsdgs21[.]onmicrosoft[.]com

gdfgzrdgfdzgdfz[.]onmicrosoft[.]com

gedltibanoja[.]onmicrosoft[.]com

Gendramdiana[.]onmicrosoft[.]com

gensapintar[.]onmicrosoft[.]com

gfhgfhfdhfaxxcvxcv[.]onmicrosoft[.]com

ggbabhnbc[.]onmicrosoft[.]com

ghfbsdgbvdsgxzvvjhg[.]onmicrosoft[.]com

ghfsdfjsafkjsadfsfjsksdgkl[.]onmicrosoft[.]com

gholncjbfgfxcbxcbc[.]onmicrosoft[.]com

ghuirfhgr[.]onmicrosoft[.]com

ghvdcvfcbcvdvcbvcjnfdvxc[.]onmicrosoft[.]com

gianurdaykxelx[.]onmicrosoft[.]com

Ginannibbaef[.]onmicrosoft[.]com

gmdk[.]onmicrosoft[.]com

gmnbkjhkre[.]onmicrosoft[.]com

gmx09[.]onmicrosoft[.]com

gogogronaanatttgor[.]onmicrosoft[.]com

gogoomd[.]onmicrosoft[.]com

goman867[.]onmicrosoft[.]com

gourmoud[.]onmicrosoft[.]com

gregorioa[.]onmicrosoft[.]com

Grigaesawtonation[.]onmicrosoft[.]com

grregwi[.]onmicrosoft[.]com

grupmacrolim[.]onmicrosoft[.]com

gruppoagarautomotive[.]onmicrosoft[.]com

gsadik[.]onmicrosoft[.]com

gsgfsdfgqsfqsw22[.]onmicrosoft[.]com

gsledefi123[.]onmicrosoft[.]com

gsromandiemaroc[.]onmicrosoft[.]com

gteszrtgszetgsdrsdfghd[.]onmicrosoft[.]com

gutenbergschuleeu[.]onmicrosoft[.]com

gzoplito[.]onmicrosoft[.]com

Hajitekmajitekom[.]onmicrosoft[.]com

hakim99[.]onmicrosoft[.]com

Hamadanbpnkpxlrrjay[.]onmicrosoft[.]com

hamiltondental[.]onmicrosoft[.]com

HARVERDuniversity[.]onmicrosoft[.]com

healingschoolemail[.]onmicrosoft[.]com

healthypro[.]onmicrosoft[.]com

HEMuniversity[.]onmicrosoft[.]com

heqesuwragl[.]onmicrosoft[.]com

hionsk[.]onmicrosoft[.]com

hm4zrtlqamzpx3ujqoxi[.]onmicrosoft[.]com

HOCHBATASCHOOL[.]onmicrosoft[.]com

hollman250[.]onmicrosoft[.]com

hossainel[.]onmicrosoft[.]com

hozamoza[.]onmicrosoft[.]com

hupljehutru[.]onmicrosoft[.]com

husunasnupzfkwbwh[.]onmicrosoft[.]com

hvitnezZYNoIkbxT[.]onmicrosoft[.]com

hxcvuybgbsdyuf[.]onmicrosoft[.]com

ICVQE[.]onmicrosoft[.]com

idealpanama[.]onmicrosoft[.]com

idorganization[.]onmicrosoft[.]com

IESGalileo[.]onmicrosoft[.]com

iesphuluong[.]onmicrosoft[.]com

iesptivs[.]onmicrosoft[.]com

illuminatiafhfUAM87d[.]onmicrosoft[.]com

imnddi[.]onmicrosoft[.]com

investalabs[.]onmicrosoft[.]com

iRushcorp[.]onmicrosoft[.]com

isam1101[.]onmicrosoft[.]com

ismailsaibari[.]onmicrosoft[.]com

itrrri[.]onmicrosoft[.]com

jajhakkjaaaa[.]onmicrosoft[.]com

Jakoswilahediti[.]onmicrosoft[.]com

jaloiuyth[.]onmicrosoft[.]com

janjniinnajj[.]onmicrosoft[.]com

jdsvfeyc[.]onmicrosoft[.]com

jelemon[.]onmicrosoft[.]com

jerem236[.]onmicrosoft[.]com

jes54canosl5ruwl[.]onmicrosoft[.]com

jhdfhksdgdasfgfdhdf[.]onmicrosoft[.]com

jkdjgdlgkdsgsaf[.]onmicrosoft[.]com

jl1ellrbaad[.]onmicrosoft[.]com

jmzafra[.]onmicrosoft[.]com

JolfintrNatinals[.]onmicrosoft[.]com

joovomail[.]onmicrosoft[.]com

jordi619[.]onmicrosoft[.]com

jothekucoth[.]onmicrosoft[.]com

jrjrtryrtkjjrrtrjjj[.]onmicrosoft[.]com

jsgtugfd[.]onmicrosoft[.]com

junioryates36tanne[.]onmicrosoft[.]com

jvq[.]onmicrosoft[.]com

kaleb6wilson[.]onmicrosoft[.]com

kamarto[.]onmicrosoft[.]com

Kamlsoasa[.]onmicrosoft[.]com

Karaitkahbjrzlkcsbyx[.]onmicrosoft[.]com

kariarikartiktt[.]onmicrosoft[.]com

kartinipintarae[.]onmicrosoft[.]com

kasbfgj[.]onmicrosoft[.]com

ketrachukapor[.]onmicrosoft[.]com

kilyanhakimi[.]onmicrosoft[.]com

kiwin[.]onmicrosoft[.]com

kkbabhnbc[.]onmicrosoft[.]com

kktmsrigading[.]onmicrosoft[.]com

kleop[.]onmicrosoft[.]com

knmal4[.]onmicrosoft[.]com

kocw[.]onmicrosoft[.]com

komachina[.]onmicrosoft[.]com

konzolamigdtqt[.]onmicrosoft[.]com

kostome[.]onmicrosoft[.]com

Krimadhadali[.]onmicrosoft[.]com

krp591[.]onmicrosoft[.]com

kudaonekagojkeylwglcx[.]onmicrosoft[.]com

kvbulandshahrsh1[.]onmicrosoft[.]com

kvplmeerut[.]onmicrosoft[.]com

kwusn[.]onmicrosoft[.]com

kxuts1kxij0lfqu4647syzhy8tqe[.]onmicrosoft[.]com

l0b3zfiocxnlp27wgp3[.]onmicrosoft[.]com

laethloiylgyr[.]onmicrosoft[.]com

Landipation[.]onmicrosoft[.]com

lesnamoureuhbsgswkmrfukz[.]onmicrosoft[.]com

lgomt[.]onmicrosoft[.]com

linseedvnzmw[.]onmicrosoft[.]com

lioe[.]onmicrosoft[.]com

lisalfr[.]onmicrosoft[.]com

Livingroommedias[.]onmicrosoft[.]com

lkhokhyidawi[.]onmicrosoft[.]com

lkmajsuhajsiag[.]onmicrosoft[.]com

lkogTrtXCvXxBNIyt[.]onmicrosoft[.]com

lkstubc[.]onmicrosoft[.]com

llechweddqbylqldlphcq[.]onmicrosoft[.]com

lpaoaifgrb[.]onmicrosoft[.]com

lrghvrb[.]onmicrosoft[.]com

lubx[.]onmicrosoft[.]com

luisdamrenantonioflayer[.]onmicrosoft[.]com

lukana108[.]onmicrosoft[.]com

lukk989[.]onmicrosoft[.]com

lungfishovwwh[.]onmicrosoft[.]com

lzomglo[.]onmicrosoft[.]com

macslister[.]onmicrosoft[.]com

maformationenligne[.]onmicrosoft[.]com

mageants[.]com

magnetiteindia[.]onmicrosoft[.]com

mailv077[.]onmicrosoft[.]com

makhhhsedu[.]onmicrosoft[.]com

MandrahiFoto[.]onmicrosoft[.]com

mathomac[.]onmicrosoft[.]com

MATIJVKD[.]onmicrosoft[.]com

matlx22[.]onmicrosoft[.]com

mcbi[.]onmicrosoft[.]com

meleamita[.]onmicrosoft[.]com

memuatiswhr[.]onmicrosoft[.]com

mhawchar[.]onmicrosoft[.]com

midox5[.]onmicrosoft[.]com

mimokhan[.]onmicrosoft[.]com

mitwarehouse[.]onmicrosoft[.]com

mkofjdgdfgsdgfdh[.]onmicrosoft[.]com

Mlawilahaxitalk[.]onmicrosoft[.]com

mlnh1u3lrbi4n0mwzwlv9q7[.]onmicrosoft[.]com

mlyaakob[.]onmicrosoft[.]com

mofbxncvxzcxvxzv[.]onmicrosoft[.]com

molanbeek[.]onmicrosoft[.]com

molebeek[.]onmicrosoft[.]com

mon259aco[.]onmicrosoft[.]com

Mosahimfe[.]onmicrosoft[.]com

mputertrainingcenter[.]onmicrosoft[.]com

Msolakpando[.]onmicrosoft[.]com

munimariquina[.]onmicrosoft[.]com

n76hvqgwvy7[.]onmicrosoft[.]com

nabu2021[.]onmicrosoft[.]com

nadthnddn[.]onmicrosoft[.]com

naglphecako[.]onmicrosoft[.]com

nahjaltaj[.]onmicrosoft[.]com

najedanjafebxn[.]onmicrosoft[.]com

naswucitrocr[.]onmicrosoft[.]com

nelsony[.]onmicrosoft[.]com

nenehatunoo[.]onmicrosoft[.]com

nertvoxss[.]onmicrosoft[.]com

netk[.]onmicrosoft[.]com

NETORG16229711[.]onmicrosoft[.]com

NETORG254522[.]onmicrosoft[.]com

NETORGFT1381299[.]onmicrosoft[.]com

NETORGFT3280115[.]onmicrosoft[.]com

NETORGFT7307202[.]onmicrosoft[.]com

newcomptatours[.]onmicrosoft[.]com

newsfoxfinal[.]onmicrosoft[.]com

nfgdtrsgyhu[.]onmicrosoft[.]com

nicewomen[.]onmicrosoft[.]com

Nightelligence[.]onmicrosoft[.]com

nikol73fq[.]onmicrosoft[.]com

ninobiloti[.]onmicrosoft[.]com

nmadinake[.]onmicrosoft[.]com

nmoluye[.]onmicrosoft[.]com

nmrekre[.]onmicrosoft[.]com

nndghsdfs18[.]onmicrosoft[.]com

nokoxukejuhi[.]onmicrosoft[.]com

nordany390[.]onmicrosoft[.]com

notaiodanielacalenda[.]onmicrosoft[.]com

novamixnf[.]onmicrosoft[.]com

nshrtt[.]onmicrosoft[.]com

ntao[.]onmicrosoft[.]com

nuevasprofesiones[.]onmicrosoft[.]com

oamtal[.]onmicrosoft[.]com

oefenstofyhvexhuqchfk[.]onmicrosoft[.]com

oggognighil[.]onmicrosoft[.]com

oippreyghs[.]onmicrosoft[.]com

oiyrdhfgdtes[.]onmicrosoft[.]com

Olakmapiob[.]onmicrosoft[.]com

ollceduph[.]onmicrosoft[.]com

omran035[.]onmicrosoft[.]com

op1avi79xsaosmk3[.]onmicrosoft[.]com

opam[.]onmicrosoft[.]com

opheliapark33galil[.]onmicrosoft[.]com

organezatinee[.]onmicrosoft[.]com

osvechigench[.]onmicrosoft[.]com

ottoking28raybe[.]onmicrosoft[.]com

ouypw7r87wr[.]onmicrosoft[.]com

p3e1mype4chezuxoio[.]onmicrosoft[.]com

p8iouupio7[.]onmicrosoft[.]com

Pa05ulineAPena[.]onmicrosoft[.]com

Palosazz[.]onmicrosoft[.]com

papillonparistrait[.]onmicrosoft[.]com

PattersonFletchers[.]onmicrosoft[.]com

PawloMaldinas[.]onmicrosoft[.]com

PawmalHawmadiana[.]onmicrosoft[.]com

pawpawaaaw[.]onmicrosoft[.]com

pbiij2[.]onmicrosoft[.]com

pdthahuytap[.]onmicrosoft[.]com

pdtnguyenduyhieu[.]onmicrosoft[.]com

PearlProductions[.]onmicrosoft[.]com

pepelkdfjgh[.]onmicrosoft[.]com

petrlhlwopr[.]onmicrosoft[.]com

phao07[.]onmicrosoft[.]com

phastovuvls[.]onmicrosoft[.]com

pjiouefbvewdghwjeif[.]onmicrosoft[.]com

pldakfgz[.]onmicrosoft[.]com

pldobritra[.]onmicrosoft[.]com

Plintadedrojhadikla[.]onmicrosoft[.]com

poksehnd[.]onmicrosoft[.]com

polandika[.]onmicrosoft[.]com

poltekkespontianak[.]onmicrosoft[.]com

popolakakaa[.]onmicrosoft[.]com

poutin[.]onmicrosoft[.]com

priviewonline[.]onmicrosoft[.]com

proofpointhost[.]onmicrosoft[.]com

PS02no[.]onmicrosoft[.]com

ps65si[.]onmicrosoft[.]com

punitscgwgmewbthvv[.]onmicrosoft[.]com

q6w[.]onmicrosoft[.]com

qazcdgsfdcgjzczCfdgc[.]onmicrosoft[.]com

qg7105hiojx7bbsvbinde[.]onmicrosoft[.]com

qhtyq8c4pmv1pqri84myzkkp[.]onmicrosoft[.]com

Quantradrabid[.]onmicrosoft[.]com

qwruiegqeukg[.]onmicrosoft[.]com

qx22pl1q75moq63zc9wffemp[.]onmicrosoft[.]com

r9dxuxxmohsy4swiuwczo3mm72[.]onmicrosoft[.]com

rafethubrlx[.]onmicrosoft[.]com

ramirocaroguamuchil[.]onmicrosoft[.]com

raqaradromoq[.]onmicrosoft[.]com

Ratoplsoltn[.]onmicrosoft[.]com

redesmedicasips[.]onmicrosoft[.]com

reonenergy[.]onmicrosoft[.]com

retyfyquef[.]onmicrosoft[.]com

rezgaawdddizvpkzt[.]onmicrosoft[.]com

rkgfderwredu[.]onmicrosoft[.]com

rmconline[.]onmicrosoft[.]com

rongabam[.]onmicrosoft[.]com

rorjolaarojolo[.]onmicrosoft[.]com

rosita2007Yfb[.]onmicrosoft[.]com

rrthfdxhfdzhsfdhf[.]onmicrosoft[.]com

rtrhgftrehhg[.]onmicrosoft[.]com

rvueduin[.]onmicrosoft[.]com

s4okfa1sd8ikxel1gub0o5cl963[.]onmicrosoft[.]com

saaiidiaa[.]onmicrosoft[.]com

sabvfr7ea[.]onmicrosoft[.]com

sadikhngggfh[.]onmicrosoft[.]com

safehavenwildlifee[.]onmicrosoft[.]com

saiani[.]onmicrosoft[.]com

salamoalyukin[.]onmicrosoft[.]com

Salitomnhadxis[.]onmicrosoft[.]com

Sarneadvenosipsl[.]onmicrosoft[.]com

SCHOOLSDEFE[.]onmicrosoft[.]com

sddffsfsff[.]onmicrosoft[.]com

sdfgjg[.]onmicrosoft[.]com

sdfsagsdghsdgdsads[.]onmicrosoft[.]com

sdgvxcsfgxvccxvsdgfchsgbvcbfxcb[.]onmicrosoft[.]com

sdht[.]onmicrosoft[.]com

sdihrazem[.]onmicrosoft[.]com

sdn02winongohebat[.]onmicrosoft[.]com

sdn1sima[.]onmicrosoft[.]com

sdn1sumba[.]onmicrosoft[.]com

sdndemangsatu[.]onmicrosoft[.]com

sdnrejomulyo2smart[.]onmicrosoft[.]com

sdrfsfsfxsfxs[.]onmicrosoft[.]com

serftcrc[.]onmicrosoft[.]com

Sharontalikabotra1[.]onmicrosoft[.]com

SHOOLATIONBETAS[.]onmicrosoft[.]com

sikzefyde[.]onmicrosoft[.]com

sixstep0roundsxhoafeebnbl[.]onmicrosoft[.]com

skhinat[.]onmicrosoft[.]com

skpc0ntxntb8je58sqr[.]onmicrosoft[.]com

skypesksm[.]onmicrosoft[.]com

skyvictory[.]onmicrosoft[.]com

Slagterdmusj[.]onmicrosoft[.]com

slerfdggb[.]onmicrosoft[.]com

smakljsfdsv[.]onmicrosoft[.]com

smanegeri4madiun[.]onmicrosoft[.]com

smpn5kotamadiun[.]onmicrosoft[.]com

SNISTI[.]onmicrosoft[.]com

snnssmartact[.]onmicrosoft[.]com

sofrane[.]onmicrosoft[.]com

solareus[.]onmicrosoft[.]com

Solfriedzamreioqzpec[.]onmicrosoft[.]com

solomams[.]onmicrosoft[.]com

soltanika[.]onmicrosoft[.]com

souelinpelin[.]onmicrosoft[.]com

spboczow[.]onmicrosoft[.]com

speckvc[.]onmicrosoft[.]com

spomifozlxes[.]onmicrosoft[.]com

spothlpijlca[.]onmicrosoft[.]com

spufrabrusp[.]onmicrosoft[.]com

srbvrere[.]onmicrosoft[.]com

stacey025[.]onmicrosoft[.]com

stchrisnlvorg[.]onmicrosoft[.]com

stiswatotlx1d4it[.]onmicrosoft[.]com

stzu[.]onmicrosoft[.]com

supportjharkhand[.]onmicrosoft[.]com

Swasamsakhet[.]onmicrosoft[.]com

swojafutewr[.]onmicrosoft[.]com

t1chile[.]onmicrosoft[.]com

tabardda[.]onmicrosoft[.]com

tachlfonewl[.]onmicrosoft[.]com

tajosapintar[.]onmicrosoft[.]com

takhbout[.]onmicrosoft[.]com

talkhcha[.]onmicrosoft[.]com

tamaynout[.]onmicrosoft[.]com

tangermedd[.]onmicrosoft[.]com

TangierSchool[.]onmicrosoft[.]com

TanokamlPa[.]onmicrosoft[.]com

Tantondyali[.]onmicrosoft[.]com

taskaobnshhopffrm[.]onmicrosoft[.]com

tdyhsabatv[.]onmicrosoft[.]com

te915704543[.]onmicrosoft[.]com

teclive[.]onmicrosoft[.]com

TempestCorporation[.]onmicrosoft[.]com

TexasWomanssUniversity[.]onmicrosoft[.]com

thanhto97[.]onmicrosoft[.]com

thasp4vlw8dre3[.]onmicrosoft[.]com

thelaast[.]onmicrosoft[.]com

thequestlvv[.]onmicrosoft[.]com

thnhuhanh[.]onmicrosoft[.]com

THPTHaiBaTrung650[.]onmicrosoft[.]com

THPTNgoQuyen914[.]onmicrosoft[.]com

THPTNguyenThiMinhKhaii[.]onmicrosoft[.]com

THPTPhamNguLao414[.]onmicrosoft[.]com

THPTPhanChuTrinh530[.]onmicrosoft[.]com

thptthanglongg[.]onmicrosoft[.]com

tichimot[.]onmicrosoft[.]com

TijaniKamlaPower[.]onmicrosoft[.]com

tpthat[.]onmicrosoft[.]com

traviandola[.]onmicrosoft[.]com

tregfere[.]onmicrosoft[.]com

tresepeswoku[.]onmicrosoft[.]com

trizui[.]onmicrosoft[.]com

trufescqtwdxqdwjxka[.]onmicrosoft[.]com

ttawryit[.]onmicrosoft[.]com

ttslymn[.]onmicrosoft[.]com

ttuoyai403yrzdgwkoa54cc[.]onmicrosoft[.]com

Tuenancvjmxgepiyz[.]onmicrosoft[.]com

txi7lpup2gre44foz[.]onmicrosoft[.]com

tymtyiug[.]onmicrosoft[.]com

uhcl0[.]mail[.]onmicrosoft[.]com

uiowaedu[.]onmicrosoft[.]com

uke2pr25nkp821k3jl76k7hve[.]onmicrosoft[.]com

ukran659ia[.]onmicrosoft[.]com

Umbojgfsm[.]onmicrosoft[.]com

unej[.]onmicrosoft[.]com

universitasklabat[.]onmicrosoft[.]com

uopedupk[.]onmicrosoft[.]com

vdxm[.]onmicrosoft[.]com

vebelfetzeryeagsblxfmkh[.]onmicrosoft[.]com

veroty[.]onmicrosoft[.]com

vgsrtsdrtdsrszedfghiu[.]onmicrosoft[.]com

vmeb[.]onmicrosoft[.]com

vmlw[.]onmicrosoft[.]com

volman683[.]onmicrosoft[.]com

VolsDirect[.]onmicrosoft[.]com

vRn4c4XNkAJenniferx2tx2k4[.]onmicrosoft[.]com

vrtbgtryt[.]onmicrosoft[.]com

vslu[.]onmicrosoft[.]com

vuc9thicrexog6vlt[.]onmicrosoft[.]com

vunx[.]onmicrosoft[.]com

vyzdinisxskmevimvprn[.]onmicrosoft[.]com

watkinsod[.]onmicrosoft[.]com

webrupridrom[.]onmicrosoft[.]com

wejdahawiya[.]onmicrosoft[.]com

wilimoliro[.]onmicrosoft[.]com

wilyamkimo[.]onmicrosoft[.]com

worldeconomynrhoa[.]onmicrosoft[.]com

wostocrifru[.]onmicrosoft[.]com

wrobrocoged[.]onmicrosoft[.]com

wvbonxl[.]onmicrosoft[.]com

x0056xb[.]onmicrosoft[.]com

x09jykh[.]onmicrosoft[.]com

x0j93o6[.]onmicrosoft[.]com

x0qb7mu[.]onmicrosoft[.]com

x0r9au9[.]onmicrosoft[.]com

x0t7m4h[.]onmicrosoft[.]com

x12vdf6[.]onmicrosoft[.]com

x12x9k9[.]onmicrosoft[.]com

x1wg2y7[.]onmicrosoft[.]com

x203673[.]onmicrosoft[.]com

x274f7q[.]onmicrosoft[.]com

x289lb5[.]onmicrosoft[.]com

x2985tc[.]onmicrosoft[.]com

x2kg16f[.]onmicrosoft[.]com

x32974e[.]onmicrosoft[.]com

x3z8e1m[.]onmicrosoft[.]com

x4i4302[.]onmicrosoft[.]com

x4i4ztf[.]onmicrosoft[.]com

x4was2m[.]onmicrosoft[.]com

x55b604[.]onmicrosoft[.]com

x5jcild[.]onmicrosoft[.]com

x61ktlp[.]onmicrosoft[.]com

x62p9qh[.]onmicrosoft[.]com

x66tm4j[.]onmicrosoft[.]com

x686b0n[.]onmicrosoft[.]com

x6g4153[.]onmicrosoft[.]com

x6pjs76[.]onmicrosoft[.]com

x6tl4l3[.]onmicrosoft[.]com

x793409[.]onmicrosoft[.]com

x7ax5fg[.]onmicrosoft[.]com

x7tu336[.]onmicrosoft[.]com

x81x202[.]onmicrosoft[.]com

x82wu7f[.]onmicrosoft[.]com

x8674lj[.]onmicrosoft[.]com

x884518[.]onmicrosoft[.]com

x88kv2i[.]onmicrosoft[.]com

x8m6805[.]onmicrosoft[.]com

x91y24t[.]onmicrosoft[.]com

x97439g[.]onmicrosoft[.]com

x982369[.]onmicrosoft[.]com

x98qpls[.]onmicrosoft[.]com

x99jcxn[.]onmicrosoft[.]com

x9ecv3o[.]onmicrosoft[.]com

x9f0o0r[.]onmicrosoft[.]com

x9mqut3[.]onmicrosoft[.]com

x9n9vlm[.]onmicrosoft[.]com

x9oe1n6[.]onmicrosoft[.]com

x9pe13q[.]onmicrosoft[.]com

x9ua89q[.]onmicrosoft[.]com

xa03k9q[.]onmicrosoft[.]com

xa0x74g[.]onmicrosoft[.]com

xa332t8[.]onmicrosoft[.]com

xb5r038[.]onmicrosoft[.]com

xbncvyuewf[.]onmicrosoft[.]com

xbnx392[.]onmicrosoft[.]com

xc11026[.]onmicrosoft[.]com

xd71g1s[.]onmicrosoft[.]com

xdeeducation[.]onmicrosoft[.]com

xdeu[.]onmicrosoft[.]com

xfy63lh[.]onmicrosoft[.]com

xgi9676[.]onmicrosoft[.]com

xgy5l0a[.]onmicrosoft[.]com

xhb6g56[.]onmicrosoft[.]com

xi257d5[.]onmicrosoft[.]com

xinhuarxeszhhhizyxh[.]onmicrosoft[.]com

xj90kny[.]onmicrosoft[.]com

xjs0796[.]onmicrosoft[.]com

xk7o8d4[.]onmicrosoft[.]com

xl18o4n[.]onmicrosoft[.]com

xlue6y1[.]onmicrosoft[.]com

xm4r626[.]onmicrosoft[.]com

xmaktahdw[.]onmicrosoft[.]com

xmwsk1j[.]onmicrosoft[.]com

xn3b57u[.]onmicrosoft[.]com

xni5821[.]onmicrosoft[.]com

xo4wks0[.]onmicrosoft[.]com

xo786d3[.]onmicrosoft[.]com

xoha63j[.]onmicrosoft[.]com

xomltusocre[.]onmicrosoft[.]com

xp9l5pi[.]onmicrosoft[.]com

xpg9sg8[.]onmicrosoft[.]com

xqccoe4[.]onmicrosoft[.]com

xrkx1hm[.]onmicrosoft[.]com

xrt242t[.]onmicrosoft[.]com

xtgy1d7[.]onmicrosoft[.]com

xtheclosetsjsdjddyuznn[.]onmicrosoft[.]com

xxpq9k4[.]onmicrosoft[.]com

xxti136[.]onmicrosoft[.]com

xy10492[.]onmicrosoft[.]com

xywe660[.]onmicrosoft[.]com

xz093p6[.]onmicrosoft[.]com

xzfj068[.]onmicrosoft[.]com

Yadrimpoltion[.]onmicrosoft[.]com

Yankipankilalo[.]onmicrosoft[.]com

YedekFihbzaf[.]onmicrosoft[.]com

yivuzojumogopro[.]onmicrosoft[.]com

yohanlima[.]onmicrosoft[.]com

yorikakaamyoriii[.]onmicrosoft[.]com

youssman[.]onmicrosoft[.]com

yousssef[.]onmicrosoft[.]com

Yowami[.]onmicrosoft[.]com

Ysibaklamahibak[.]onmicrosoft[.]com

yupoo[.]onmicrosoft[.]com

yyfxhgsdwgs20[.]onmicrosoft[.]com

zahgb[.]onmicrosoft[.]com

zavetrinutjtyz[.]onmicrosoft[.]com

zbijzhzjzhzjzjzhzdz[.]onmicrosoft[.]com

zbikdjdksdkskdjedfef[.]onmicrosoft[.]com

zbmxs[.]onmicrosoft[.]com

zefrefregre[.]onmicrosoft[.]com

zihlficroph[.]onmicrosoft[.]com

zomzaaam[.]onmicrosoft[.]com