Key Findings
- In March, Proofpoint researchers identified spam campaigns being relayed through a small number of Proofpoint customers’ email infrastructure by sending spam from Microsoft 365 tenants
- All analyses indicate this activity was conducted by one spam actor, whose activity we do not attribute to a known entity
- The root cause is a modifiable email routing configuration feature on Proofpoint servers to allow relay of organizations’ outbound messages from Microsoft 365 tenants, but without specifying which M365 tenants to allow
- To resolve the issue, Proofpoint implemented a streamlined administrative interface for customers to specify which M365 tenants are allowed to relay, with all other M365 tenants denied by default
- Any email infrastructure that offers this email routing configuration feature can be abused by spammers
- Proofpoint Essentials customers are not affected, as configuration settings are already set that prevent unauthorized relay abuse
- This issue did not expose any Proofpoint customer data, and no customer experienced any data loss as a result
- We are sharing what we know about these campaigns to help others mitigate this issue and prevent further unauthorized abuse, as it is not unique to Proofpoint
Abusing an Outbound Email Relay Configuration to Conduct Spam Campaigns
In March 2024, Proofpoint observed spam campaigns being relayed from Microsoft 365 tenants through several Proofpoint enterprise customers’ email infrastructures, targeting users of free email providers such as Yahoo, Gmail, and GMX. The commonality shared between all the customers whose email infrastructures were being abused was a modifiable configuration setting that allowed outbound messages to be relayed from Microsoft 365. Spammers can therefore abuse any email infrastructure that allows messages to be relayed from email hosting services through their infrastructure.
This specific email routing configuration abused by the spammer allowed outbound messages to be sent from a customer’s Microsoft 365 tenant for relay through their infrastructure, but it did not limit the Microsoft tenants allowed to relay.
The spammer, whose activity we do not attribute to a known entity, controlled Microsoft 365 tenants that used random strings of letters and numbers, such as 23gdfs56gsd.onmicrosoft.com, for some of the spam messages. Some of the spam made no attempt to disguise the sender address and used the oddly named Microsoft tenant names as the sending domain. Some of spam used the onmicrosoft.com tenant names in the “from” field and other spam messages spoofed the sender email, not all of which were successfully delivered. Interestingly, while the spammer tried this against several Proofpoint infrastructures, some accepted the messages for relay while others rejected the messages.
The spammer spoofed the RFC822 “from” header but could not spoof the RFC821 envelope sender address. The spammer used a rotating series of leased virtual private servers (VPS) from several providers, using many different IP addresses to initiate quick bursts of thousands of messages at a time from their SMTP servers, sent to Microsoft 365 to be relayed to Proofpoint-hosted customer servers.
Microsoft 365 accepted these spoofed messages and sent them to these customers’ email infrastructures to be relayed. When customer domains were spoofed while relaying through the matching customer’s email infrastructure, DKIM signing was also applied as the messages transited through the Proofpoint infrastructure, making the spam messages more deliverable.
As many of the tenants being abused by the spammer are still active as of writing, we have implemented several measures to prevent unauthorized relay through Proofpoint servers to keep our customers protected.
Taking Action to Notify and Protect Our Customers
Proofpoint quickly mobilized a cross-functional task force to identify and contact all customers that had an at-risk configuration to help them change their configuration settings, prioritizing those whose infrastructures were actively being abused. We also developed a process to ensure new customers are configured to prevent relay abuse.
We made the configuration process as easy and straightforward as possible for all customers with this specific relay setting: we provided clear instructions in both written and video formats, developed an FAQ and set up a dedicated page in our customer Community portal, issued in-product alerts, assisted customers over video meetings, and explained what could happen if the configuration was not correct.
Next, Proofpoint Threat Research identified the early warning signs of the spammer’s activity as it set up and tested new relays. By identifying the early stages of deliverability testing that preceded spam campaigns, we were able to get ahead of the spammer’s activity and proactively work with customers who could be targeted next.
We found that for some customers whose configurations were set to never block outbound messages, it was challenging to stop all the outbound spam campaigns. We therefore contacted those customers to help them change those settings as well, which further improved the effectiveness of our spam detection engines to stop the outbound relay spam campaigns based on message content. As we started to block the spammer’s activity, the spammer accelerated its testing and moved quickly to other customers. We established a continuous process of identifying the customers affected each day, re-prioritizing outreach to fix configurations.
Collaborating with the Wider Security Community
We encourage security researchers to contact vendors and service providers, such as Proofpoint, to report issues and share findings. We also shared our findings about this relay abuse with other email infrastructure providers to help them protect their customers as well. Even when the security service provider is already aware and working on a solution, an outside perspective is helpful to validate and test solutions.
During this process, we greatly appreciated the support and information provided to us by the wider security and service provider community. We received helpful reporting from several third parties, including multiple service providers and Guardio Labs, underlining the value of maintaining good technical working relationships across the industry. Guardio Labs notably provided us additional technical information that complemented our research, allowing us to more accurately reproduce the relay setup and validate that changes we instructed our customers to make were effective in stopping the relay abuse.
Key Learnings
While our response was swift once we identified the spammer’s relay abuse, quickly engaging multiple teams to prioritize remediation and support impacted customers, we are always looking to further improve our processes to reduce potential risks.
Offering relay configuration options to customers is valuable, and usability is equally important—the email infrastructure provider should ensure controls are intuitive and clearly explain the significance of setting them correctly.
We encourage email service providers to limit the power of free trial and newly created unverified tenants to send large volume outbound email campaigns, especially when relayed through other providers. Email service providers should also prevent their customer tenants from sending outbound messages that spoof a domain for which they do not have proven ownership. Curbing abuse at the source of message sending is the most effective way to reduce spam.
We also encourage virtual private server providers to limit their customers’ ability to send mass bulk spam campaigns from SMTP servers hosted on their infrastructure.
Lastly, identifying and stopping the relay abuse discussed in this blog underscores how the cybersecurity ecosystem at large benefits from collaboration and open communication across threat research and detection teams globally. Across the public and private sectors, across industries and geographies around the world, we work together to keep us all safe. We respect and value the collective contributions, open dialogue, and different insights we all offer in order keep our communities protected.
Indicators of Compromise
Below is a list of the Microsoft tenants that we have observed being abused by the spammer. As of the publication of this blog, many are still active. We have implemented several measures to prevent unauthorized relay through Proofpoint servers to keep our customers protected.
0h1[.]onmicrosoft[.]com
0reh05idlwaswiq[.]onmicrosoft[.]com
0roKxveKWDq5[.]onmicrosoft[.]com
0z8pg1vhlwny48z[.]onmicrosoft[.]com
1m2htrxg3po7e9wg2[.]onmicrosoft[.]com
23gdfs56gsd[.]onmicrosoft[.]com
2cxz1f56s[.]onmicrosoft[.]com
2db499nsln9j7w1o9a6zmu[.]onmicrosoft[.]com
2g31x56gd[.]onmicrosoft[.]com
379vojhrx0ohzotf5otdoycqc9b[.]onmicrosoft[.]com
3ihogunicotireph[.]onmicrosoft[.]com
3o2d6n4gp1xl1jo2d4ayeeogjdfw[.]onmicrosoft[.]com
4eri3reraqib3tet[.]onmicrosoft[.]com
4fi0[.]onmicrosoft[.]com
4h8gf5h4gd8y[.]onmicrosoft[.]com
4ritajubrefica[.]onmicrosoft[.]com
58frghyqsz[.]onmicrosoft[.]com
5hbnbrcdds[.]onmicrosoft[.]com
5lwiroplbrusldit[.]onmicrosoft[.]com
6ba4a90bnmp9xsqa[.]onmicrosoft[.]com
6bnfdvbdf[.]onmicrosoft[.]com
6pd6lkrsp94ma1sglb146[.]onmicrosoft[.]com
6pq[.]onmicrosoft[.]com
6zc8sx[.]onmicrosoft[.]com
785fvinrs4et5b2cqwt9xc[.]onmicrosoft[.]com
a9mnqbsvmfmre[.]onmicrosoft[.]com
aaahyamartiniilii[.]onmicrosoft[.]com
AAAUS21[.]onmicrosoft[.]com
aalimm[.]onmicrosoft[.]com
aarasdtyj[.]onmicrosoft[.]com
abab01[.]onmicrosoft[.]com
abandonedlittleand[.]onmicrosoft[.]com
Abbildhpfpmptunphe[.]onmicrosoft[.]com
academiaedu[.]onmicrosoft[.]com
accedubz[.]onmicrosoft[.]com
adfgghdfbgjgsdf[.]onmicrosoft[.]com
adncolkilsopmaq[.]onmicrosoft[.]com
adorableamazon81[.]onmicrosoft[.]com
aebx[.]onmicrosoft[.]com
Afconziyech[.]onmicrosoft[.]com
afdagfdasgdsgasf[.]onmicrosoft[.]com
afqweiufa[.]onmicrosoft[.]com
africatobeonaws[.]onmicrosoft[.]com
afyutqgyt[.]onmicrosoft[.]com
ahidosnait32ta[.]onmicrosoft[.]com
akha[.]onmicrosoft[.]com
akhir22[.]onmicrosoft[.]com
alahalmostan[.]onmicrosoft[.]com
alawasa[.]onmicrosoft[.]com
algammou[.]onmicrosoft[.]com
almotanabi[.]onmicrosoft[.]com
alumavaxklczryzdlzr[.]onmicrosoft[.]com
amana770[.]onmicrosoft[.]com
amimer2[.]onmicrosoft[.]com
AndrWalsh[.]onmicrosoft[.]com
angelicoo[.]onmicrosoft[.]com
antlisa[.]onmicrosoft[.]com
antonya777[.]onmicrosoft[.]com
artogrulghazi[.]onmicrosoft[.]com
asdfghjukil[.]onmicrosoft[.]com
asgarskk[.]onmicrosoft[.]com
asxzashdf[.]onmicrosoft[.]com
aty6reynoja[.]onmicrosoft[.]com
avericraig31kayla[.]onmicrosoft[.]com
avts9yq7f[.]onmicrosoft[.]com
ayfgswyhde[.]onmicrosoft[.]com
ayoubel[.]onmicrosoft[.]com
ayoubserghini[.]onmicrosoft[.]com
azalwendo[.]onmicrosoft[.]com
azasarghimnhgt[.]onmicrosoft[.]com
babonutlbekak0[.]onmicrosoft[.]com
bamrong[.]onmicrosoft[.]com
bamronga[.]onmicrosoft[.]com
bandalignano[.]onmicrosoft[.]com
BansheeSystems[.]onmicrosoft[.]com
Barondialhxixa[.]onmicrosoft[.]com
barteman[.]onmicrosoft[.]com
batmanlight[.]onmicrosoft[.]com
Battisteljobmh[.]onmicrosoft[.]com
bawrehiqlml[.]onmicrosoft[.]com
bbhlibraryd[.]onmicrosoft[.]com
beholdendgepoasiafqg[.]onmicrosoft[.]com
BenghaziPolanda[.]onmicrosoft[.]com
berga015[.]onmicrosoft[.]com
bernadno[.]onmicrosoft[.]com
bewoforoqez[.]onmicrosoft[.]com
bgty015q[.]onmicrosoft[.]com
biblicalwott[.]onmicrosoft[.]com
bibozi2[.]onmicrosoft[.]com
blackboxcmyztkdplwxh[.]onmicrosoft[.]com
blackbun[.]onmicrosoft[.]com
blancom[.]onmicrosoft[.]com
blever3490frlbh[.]onmicrosoft[.]com
bolmendo[.]onmicrosoft[.]com
bonjourvistagqhgq[.]onmicrosoft[.]com
brablconlw[.]onmicrosoft[.]com
bridgemarynet[.]onmicrosoft[.]com
BrikidialiHadakg[.]onmicrosoft[.]com
Brittany96Howell[.]onmicrosoft[.]com
bsarghimnhgt[.]onmicrosoft[.]com
bsevtat[.]onmicrosoft[.]com
bsleopoldsburgbe[.]onmicrosoft[.]com
Bugiadabzefipooluct[.]onmicrosoft[.]com
buwvbjffzn[.]onmicrosoft[.]com
bxcvugsduyfg[.]onmicrosoft[.]com
bzalwendo[.]onmicrosoft[.]com
bzsigmond[.]onmicrosoft[.]com
bzxcubgsudfygs[.]onmicrosoft[.]com
c3u2g5w67[.]onmicrosoft[.]com
cabejantszcpod[.]onmicrosoft[.]com
Car9olenger[.]onmicrosoft[.]com
ccwswrs[.]onmicrosoft[.]com
cdnpavianet[.]onmicrosoft[.]com
Centralofices[.]onmicrosoft[.]com
cfbabhnbc[.]onmicrosoft[.]com
cfcnglns65p07a512l[.]onmicrosoft[.]com
cfroou32qar[.]onmicrosoft[.]com
chcsmez[.]onmicrosoft[.]com
chihabafilal323@gmail[.]com
chiwrlx5x4gastukl[.]onmicrosoft[.]com
chopevemucr[.]onmicrosoft[.]com
citlallicvkbswzeiosks[.]onmicrosoft[.]com
civiluH1Ncpumuan[.]onmicrosoft[.]com
clementy618[.]onmicrosoft[.]com
clemon108[.]onmicrosoft[.]com
cliejgred[.]onmicrosoft[.]com
cmchmaristascl[.]onmicrosoft[.]com
colombiaancestral[.]onmicrosoft[.]com
comntrewafhdfdgklop[.]onmicrosoft[.]com
costamarsh[.]onmicrosoft[.]com
counde[.]onmicrosoft[.]com
croissantfrech[.]onmicrosoft[.]com
cshhg[.]onmicrosoft[.]com
cuhwbak[.]onmicrosoft[.]com
custowawrav[.]onmicrosoft[.]com
cuxicadoweb[.]onmicrosoft[.]com
cxvgsdgcvsdxvdbcxbc[.]onmicrosoft[.]com
czarbok[.]onmicrosoft[.]com
czoplito[.]onmicrosoft[.]com
d1a7f1g4hr[.]onmicrosoft[.]com
dahmadbotfonast[.]onmicrosoft[.]com
dawriespani[.]onmicrosoft[.]com
dcbatfdgvcj[.]onmicrosoft[.]com
dctln[.]onmicrosoft[.]com
decrninja[.]onmicrosoft[.]com
denmarkmenshed[.]onmicrosoft[.]com
dffsuighth[.]onmicrosoft[.]com
dfgfdgsdFshdfjdskdj[.]onmicrosoft[.]com
dfghjftykiuy[.]onmicrosoft[.]com
dfgjswediusd[.]onmicrosoft[.]com
dfjiduhfuiidfdiifhdofijfoi[.]onmicrosoft[.]com
dfkgeifgquyfg[.]onmicrosoft[.]com
dgfvcbxcgzcbfchfcvbcbcxfnb[.]onmicrosoft[.]com
dghdfgsdgfdg[.]onmicrosoft[.]com
dgvcxbfdxjbnvcxnfdzhv[.]onmicrosoft[.]com
dgvkusdlgsidg[.]onmicrosoft[.]com
dhfcvbdzgvbbdsfdvxcvdxcbxcbm[.]onmicrosoft[.]com
dhfgweyftwuqaresd[.]onmicrosoft[.]com
dhgfjjdsgjskdgdjsgsd[.]onmicrosoft[.]com
dhim70dz9zkcytkrngjod95g2qqw[.]onmicrosoft[.]com
dhjfcvydc[.]onmicrosoft[.]com
didiernsf[.]onmicrosoft[.]com
dihupraspu7pugo[.]onmicrosoft[.]com
dinzashdf[.]onmicrosoft[.]com
ditlaviovy[.]onmicrosoft[.]com
djawdbawd[.]onmicrosoft[.]com
dkttc[.]onmicrosoft[.]com
dlmsjnhkji[.]onmicrosoft[.]com
dnghkc[.]onmicrosoft[.]com
domnef[.]onmicrosoft[.]com
doublon7[.]onmicrosoft[.]com
dqroenztuk19z30do97vs[.]onmicrosoft[.]com
draglnlfrost[.]onmicrosoft[.]com
drgcsdfgxcvsfxcfdxg[.]onmicrosoft[.]com
druqaqiphehix[.]onmicrosoft[.]com
dsastxdd[.]onmicrosoft[.]com
dsghfjsajsdgkjsd[.]onmicrosoft[.]com
dshhg[.]onmicrosoft[.]com
dsumed[.]onmicrosoft[.]com
DTRDxRTcRDCDRvUYf[.]onmicrosoft[.]com
dughsjkdhu[.]onmicrosoft[.]com
dxgrydzsryy[.]onmicrosoft[.]com
dxhgdghxdgdshbvcnxfhd[.]onmicrosoft[.]com
dzagrebj[.]onmicrosoft[.]com
dzoplito[.]onmicrosoft[.]com
e2t1ubd1z5[.]onmicrosoft[.]com
e5133a21vnlao5vf[.]onmicrosoft[.]com
echvmtw[.]onmicrosoft[.]com
edc2015[.]onmicrosoft[.]com
edenlidichanlfkkrmcukfte[.]onmicrosoft[.]com
edu[.]echvmtw[.]onmicrosoft[.]com
edu[.]lioe[.]onmicrosoft[.]com
educationapple96[.]onmicrosoft[.]com
EDUVAERSD[.]onmicrosoft[.]com
eebabhnbc[.]onmicrosoft[.]com
eerasdtyj[.]onmicrosoft[.]com
efjhdshfe[.]onmicrosoft[.]com
EFLEETSYSTEMS[.]onmicrosoft[.]com
efuiwefhjhj[.]onmicrosoft[.]com
egdgsadgdxvdcvfcbchgkgf[.]onmicrosoft[.]com
egressyeu[.]onmicrosoft[.]com
elevenom[.]onmicrosoft[.]com
elisitalianesta[.]onmicrosoft[.]com
elllaksnj[.]onmicrosoft[.]com
emailcontact132[.]onmicrosoft[.]com
enjoylifemanimbdqylkposv[.]onmicrosoft[.]com
Erdwalzehyflp[.]onmicrosoft[.]com
ergdbvvf[.]onmicrosoft[.]com
erwfiuhkjrewiuew[.]onmicrosoft[.]com
esdgrhfl[.]onmicrosoft[.]com
everyonecanhelp[.]onmicrosoft[.]com
EYYytCYTYuyfyuDTRD[.]onmicrosoft[.]com
f1sd5a4f[.]onmicrosoft[.]com
f4h5gf56gf[.]onmicrosoft[.]com
FacultySSX[.]onmicrosoft[.]com
fadolii[.]onmicrosoft[.]com
fadwujahdjdfffgkgg[.]onmicrosoft[.]com
fagomlvache[.]onmicrosoft[.]com
farahmsw56956[.]onmicrosoft[.]com
farocapital365[.]onmicrosoft[.]com
Farpmdldasa[.]onmicrosoft[.]com
fas83[.]onmicrosoft[.]com
fasmetonm[.]onmicrosoft[.]com
fastarvqutz[.]onmicrosoft[.]com
fcbvbnxchngfjgvnbxcbz[.]onmicrosoft[.]com
fdgcvbxcdcbcgxcbdfxvc[.]onmicrosoft[.]com
fdgfdgdgsdgdsf[.]onmicrosoft[.]com
fdghfbszgxcgdhvcbfsdgcb[.]onmicrosoft[.]com
fdhdgdgsgfhfjgfjopmknjubh[.]onmicrosoft[.]com
fdhdsgsdhfgfjdsdfs[.]onmicrosoft[.]com
fdhfdhsdgbcsdgsfdgdfcbsdfg[.]onmicrosoft[.]com
feadsges[.]onmicrosoft[.]com
felnder[.]onmicrosoft[.]com
fenzd[.]onmicrosoft[.]com
ferione[.]onmicrosoft[.]com
fexoswetldrlwlpadusa[.]onmicrosoft[.]com
fgbgfbtsbg[.]onmicrosoft[.]com
fgbhghtrghtrhgrthrthtrhrt[.]onmicrosoft[.]com
fgdfgdsg454dfdcf45[.]onmicrosoft[.]com
fgdsjfjkgdsJKAG[.]onmicrosoft[.]com
fghdfcvbdvxvxgvcnchbvcnfdn[.]onmicrosoft[.]com
fghfdghfdfhvbrfdgcfdhfv[.]onmicrosoft[.]com
fghfhd54654tfghgf[.]onmicrosoft[.]com
fgjdrzhsfdhfdldg[.]onmicrosoft[.]com
fhcrecycled[.]onmicrosoft[.]com
fhdgdghdskgjgsfs[.]onmicrosoft[.]com
fidelitiasom[.]onmicrosoft[.]com
fiscalizadoorcopampa[.]onmicrosoft[.]com
fitolrti[.]onmicrosoft[.]com
fiv3cake5riste[.]onmicrosoft[.]com
frakutrlhlp[.]onmicrosoft[.]com
FrantisekVesely[.]onmicrosoft[.]com
frend265[.]onmicrosoft[.]com
freslzuphly[.]onmicrosoft[.]com
frtotajhdjjgkjdssa[.]onmicrosoft[.]com
fsiwatyahs[.]onmicrosoft[.]com
fuaqgfjyagfuy[.]onmicrosoft[.]com
fukcujckckckc[.]onmicrosoft[.]com
furgeson862[.]onmicrosoft[.]com
fvoopk410a[.]onmicrosoft[.]com
g231ds564gs[.]onmicrosoft[.]com
gafaacat[.]onmicrosoft[.]com
gaitasineticaRB[.]onmicrosoft[.]com
Galomandationd[.]onmicrosoft[.]com
ganeshhimal2[.]onmicrosoft[.]com
gau08[.]onmicrosoft[.]com
gcfgsqsdgs21[.]onmicrosoft[.]com
gdfgzrdgfdzgdfz[.]onmicrosoft[.]com
gedltibanoja[.]onmicrosoft[.]com
Gendramdiana[.]onmicrosoft[.]com
gensapintar[.]onmicrosoft[.]com
gfhgfhfdhfaxxcvxcv[.]onmicrosoft[.]com
ggbabhnbc[.]onmicrosoft[.]com
ghfbsdgbvdsgxzvvjhg[.]onmicrosoft[.]com
ghfsdfjsafkjsadfsfjsksdgkl[.]onmicrosoft[.]com
gholncjbfgfxcbxcbc[.]onmicrosoft[.]com
ghuirfhgr[.]onmicrosoft[.]com
ghvdcvfcbcvdvcbvcjnfdvxc[.]onmicrosoft[.]com
gianurdaykxelx[.]onmicrosoft[.]com
Ginannibbaef[.]onmicrosoft[.]com
gmdk[.]onmicrosoft[.]com
gmnbkjhkre[.]onmicrosoft[.]com
gmx09[.]onmicrosoft[.]com
gogogronaanatttgor[.]onmicrosoft[.]com
gogoomd[.]onmicrosoft[.]com
goman867[.]onmicrosoft[.]com
gourmoud[.]onmicrosoft[.]com
gregorioa[.]onmicrosoft[.]com
Grigaesawtonation[.]onmicrosoft[.]com
grregwi[.]onmicrosoft[.]com
grupmacrolim[.]onmicrosoft[.]com
gruppoagarautomotive[.]onmicrosoft[.]com
gsadik[.]onmicrosoft[.]com
gsgfsdfgqsfqsw22[.]onmicrosoft[.]com
gsledefi123[.]onmicrosoft[.]com
gsromandiemaroc[.]onmicrosoft[.]com
gteszrtgszetgsdrsdfghd[.]onmicrosoft[.]com
gutenbergschuleeu[.]onmicrosoft[.]com
gzoplito[.]onmicrosoft[.]com
Hajitekmajitekom[.]onmicrosoft[.]com
hakim99[.]onmicrosoft[.]com
Hamadanbpnkpxlrrjay[.]onmicrosoft[.]com
hamiltondental[.]onmicrosoft[.]com
HARVERDuniversity[.]onmicrosoft[.]com
healingschoolemail[.]onmicrosoft[.]com
healthypro[.]onmicrosoft[.]com
HEMuniversity[.]onmicrosoft[.]com
heqesuwragl[.]onmicrosoft[.]com
hionsk[.]onmicrosoft[.]com
hm4zrtlqamzpx3ujqoxi[.]onmicrosoft[.]com
HOCHBATASCHOOL[.]onmicrosoft[.]com
hollman250[.]onmicrosoft[.]com
hossainel[.]onmicrosoft[.]com
hozamoza[.]onmicrosoft[.]com
hupljehutru[.]onmicrosoft[.]com
husunasnupzfkwbwh[.]onmicrosoft[.]com
hvitnezZYNoIkbxT[.]onmicrosoft[.]com
hxcvuybgbsdyuf[.]onmicrosoft[.]com
ICVQE[.]onmicrosoft[.]com
idealpanama[.]onmicrosoft[.]com
idorganization[.]onmicrosoft[.]com
IESGalileo[.]onmicrosoft[.]com
iesphuluong[.]onmicrosoft[.]com
iesptivs[.]onmicrosoft[.]com
illuminatiafhfUAM87d[.]onmicrosoft[.]com
imnddi[.]onmicrosoft[.]com
investalabs[.]onmicrosoft[.]com
iRushcorp[.]onmicrosoft[.]com
isam1101[.]onmicrosoft[.]com
ismailsaibari[.]onmicrosoft[.]com
itrrri[.]onmicrosoft[.]com
jajhakkjaaaa[.]onmicrosoft[.]com
Jakoswilahediti[.]onmicrosoft[.]com
jaloiuyth[.]onmicrosoft[.]com
janjniinnajj[.]onmicrosoft[.]com
jdsvfeyc[.]onmicrosoft[.]com
jelemon[.]onmicrosoft[.]com
jerem236[.]onmicrosoft[.]com
jes54canosl5ruwl[.]onmicrosoft[.]com
jhdfhksdgdasfgfdhdf[.]onmicrosoft[.]com
jkdjgdlgkdsgsaf[.]onmicrosoft[.]com
jl1ellrbaad[.]onmicrosoft[.]com
jmzafra[.]onmicrosoft[.]com
JolfintrNatinals[.]onmicrosoft[.]com
joovomail[.]onmicrosoft[.]com
jordi619[.]onmicrosoft[.]com
jothekucoth[.]onmicrosoft[.]com
jrjrtryrtkjjrrtrjjj[.]onmicrosoft[.]com
jsgtugfd[.]onmicrosoft[.]com
junioryates36tanne[.]onmicrosoft[.]com
jvq[.]onmicrosoft[.]com
kaleb6wilson[.]onmicrosoft[.]com
kamarto[.]onmicrosoft[.]com
Kamlsoasa[.]onmicrosoft[.]com
Karaitkahbjrzlkcsbyx[.]onmicrosoft[.]com
kariarikartiktt[.]onmicrosoft[.]com
kartinipintarae[.]onmicrosoft[.]com
kasbfgj[.]onmicrosoft[.]com
ketrachukapor[.]onmicrosoft[.]com
kilyanhakimi[.]onmicrosoft[.]com
kiwin[.]onmicrosoft[.]com
kkbabhnbc[.]onmicrosoft[.]com
kktmsrigading[.]onmicrosoft[.]com
kleop[.]onmicrosoft[.]com
knmal4[.]onmicrosoft[.]com
kocw[.]onmicrosoft[.]com
komachina[.]onmicrosoft[.]com
konzolamigdtqt[.]onmicrosoft[.]com
kostome[.]onmicrosoft[.]com
Krimadhadali[.]onmicrosoft[.]com
krp591[.]onmicrosoft[.]com
kudaonekagojkeylwglcx[.]onmicrosoft[.]com
kvbulandshahrsh1[.]onmicrosoft[.]com
kvplmeerut[.]onmicrosoft[.]com
kwusn[.]onmicrosoft[.]com
kxuts1kxij0lfqu4647syzhy8tqe[.]onmicrosoft[.]com
l0b3zfiocxnlp27wgp3[.]onmicrosoft[.]com
laethloiylgyr[.]onmicrosoft[.]com
Landipation[.]onmicrosoft[.]com
lesnamoureuhbsgswkmrfukz[.]onmicrosoft[.]com
lgomt[.]onmicrosoft[.]com
linseedvnzmw[.]onmicrosoft[.]com
lioe[.]onmicrosoft[.]com
lisalfr[.]onmicrosoft[.]com
Livingroommedias[.]onmicrosoft[.]com
lkhokhyidawi[.]onmicrosoft[.]com
lkmajsuhajsiag[.]onmicrosoft[.]com
lkogTrtXCvXxBNIyt[.]onmicrosoft[.]com
lkstubc[.]onmicrosoft[.]com
llechweddqbylqldlphcq[.]onmicrosoft[.]com
lpaoaifgrb[.]onmicrosoft[.]com
lrghvrb[.]onmicrosoft[.]com
lubx[.]onmicrosoft[.]com
luisdamrenantonioflayer[.]onmicrosoft[.]com
lukana108[.]onmicrosoft[.]com
lukk989[.]onmicrosoft[.]com
lungfishovwwh[.]onmicrosoft[.]com
lzomglo[.]onmicrosoft[.]com
macslister[.]onmicrosoft[.]com
maformationenligne[.]onmicrosoft[.]com
mageants[.]com
magnetiteindia[.]onmicrosoft[.]com
mailv077[.]onmicrosoft[.]com
makhhhsedu[.]onmicrosoft[.]com
MandrahiFoto[.]onmicrosoft[.]com
mathomac[.]onmicrosoft[.]com
MATIJVKD[.]onmicrosoft[.]com
matlx22[.]onmicrosoft[.]com
mcbi[.]onmicrosoft[.]com
meleamita[.]onmicrosoft[.]com
memuatiswhr[.]onmicrosoft[.]com
mhawchar[.]onmicrosoft[.]com
midox5[.]onmicrosoft[.]com
mimokhan[.]onmicrosoft[.]com
mitwarehouse[.]onmicrosoft[.]com
mkofjdgdfgsdgfdh[.]onmicrosoft[.]com
Mlawilahaxitalk[.]onmicrosoft[.]com
mlnh1u3lrbi4n0mwzwlv9q7[.]onmicrosoft[.]com
mlyaakob[.]onmicrosoft[.]com
mofbxncvxzcxvxzv[.]onmicrosoft[.]com
molanbeek[.]onmicrosoft[.]com
molebeek[.]onmicrosoft[.]com
mon259aco[.]onmicrosoft[.]com
Mosahimfe[.]onmicrosoft[.]com
mputertrainingcenter[.]onmicrosoft[.]com
Msolakpando[.]onmicrosoft[.]com
munimariquina[.]onmicrosoft[.]com
n76hvqgwvy7[.]onmicrosoft[.]com
nabu2021[.]onmicrosoft[.]com
nadthnddn[.]onmicrosoft[.]com
naglphecako[.]onmicrosoft[.]com
nahjaltaj[.]onmicrosoft[.]com
najedanjafebxn[.]onmicrosoft[.]com
naswucitrocr[.]onmicrosoft[.]com
nelsony[.]onmicrosoft[.]com
nenehatunoo[.]onmicrosoft[.]com
nertvoxss[.]onmicrosoft[.]com
netk[.]onmicrosoft[.]com
NETORG16229711[.]onmicrosoft[.]com
NETORG254522[.]onmicrosoft[.]com
NETORGFT1381299[.]onmicrosoft[.]com
NETORGFT3280115[.]onmicrosoft[.]com
NETORGFT7307202[.]onmicrosoft[.]com
newcomptatours[.]onmicrosoft[.]com
newsfoxfinal[.]onmicrosoft[.]com
nfgdtrsgyhu[.]onmicrosoft[.]com
nicewomen[.]onmicrosoft[.]com
Nightelligence[.]onmicrosoft[.]com
nikol73fq[.]onmicrosoft[.]com
ninobiloti[.]onmicrosoft[.]com
nmadinake[.]onmicrosoft[.]com
nmoluye[.]onmicrosoft[.]com
nmrekre[.]onmicrosoft[.]com
nndghsdfs18[.]onmicrosoft[.]com
nokoxukejuhi[.]onmicrosoft[.]com
nordany390[.]onmicrosoft[.]com
notaiodanielacalenda[.]onmicrosoft[.]com
novamixnf[.]onmicrosoft[.]com
nshrtt[.]onmicrosoft[.]com
ntao[.]onmicrosoft[.]com
nuevasprofesiones[.]onmicrosoft[.]com
oamtal[.]onmicrosoft[.]com
oefenstofyhvexhuqchfk[.]onmicrosoft[.]com
oggognighil[.]onmicrosoft[.]com
oippreyghs[.]onmicrosoft[.]com
oiyrdhfgdtes[.]onmicrosoft[.]com
Olakmapiob[.]onmicrosoft[.]com
ollceduph[.]onmicrosoft[.]com
omran035[.]onmicrosoft[.]com
op1avi79xsaosmk3[.]onmicrosoft[.]com
opam[.]onmicrosoft[.]com
opheliapark33galil[.]onmicrosoft[.]com
organezatinee[.]onmicrosoft[.]com
osvechigench[.]onmicrosoft[.]com
ottoking28raybe[.]onmicrosoft[.]com
ouypw7r87wr[.]onmicrosoft[.]com
p3e1mype4chezuxoio[.]onmicrosoft[.]com
p8iouupio7[.]onmicrosoft[.]com
Pa05ulineAPena[.]onmicrosoft[.]com
Palosazz[.]onmicrosoft[.]com
papillonparistrait[.]onmicrosoft[.]com
PattersonFletchers[.]onmicrosoft[.]com
PawloMaldinas[.]onmicrosoft[.]com
PawmalHawmadiana[.]onmicrosoft[.]com
pawpawaaaw[.]onmicrosoft[.]com
pbiij2[.]onmicrosoft[.]com
pdthahuytap[.]onmicrosoft[.]com
pdtnguyenduyhieu[.]onmicrosoft[.]com
PearlProductions[.]onmicrosoft[.]com
pepelkdfjgh[.]onmicrosoft[.]com
petrlhlwopr[.]onmicrosoft[.]com
phao07[.]onmicrosoft[.]com
phastovuvls[.]onmicrosoft[.]com
pjiouefbvewdghwjeif[.]onmicrosoft[.]com
pldakfgz[.]onmicrosoft[.]com
pldobritra[.]onmicrosoft[.]com
Plintadedrojhadikla[.]onmicrosoft[.]com
poksehnd[.]onmicrosoft[.]com
polandika[.]onmicrosoft[.]com
poltekkespontianak[.]onmicrosoft[.]com
popolakakaa[.]onmicrosoft[.]com
poutin[.]onmicrosoft[.]com
priviewonline[.]onmicrosoft[.]com
proofpointhost[.]onmicrosoft[.]com
PS02no[.]onmicrosoft[.]com
ps65si[.]onmicrosoft[.]com
punitscgwgmewbthvv[.]onmicrosoft[.]com
q6w[.]onmicrosoft[.]com
qazcdgsfdcgjzczCfdgc[.]onmicrosoft[.]com
qg7105hiojx7bbsvbinde[.]onmicrosoft[.]com
qhtyq8c4pmv1pqri84myzkkp[.]onmicrosoft[.]com
Quantradrabid[.]onmicrosoft[.]com
qwruiegqeukg[.]onmicrosoft[.]com
qx22pl1q75moq63zc9wffemp[.]onmicrosoft[.]com
r9dxuxxmohsy4swiuwczo3mm72[.]onmicrosoft[.]com
rafethubrlx[.]onmicrosoft[.]com
ramirocaroguamuchil[.]onmicrosoft[.]com
raqaradromoq[.]onmicrosoft[.]com
Ratoplsoltn[.]onmicrosoft[.]com
redesmedicasips[.]onmicrosoft[.]com
reonenergy[.]onmicrosoft[.]com
retyfyquef[.]onmicrosoft[.]com
rezgaawdddizvpkzt[.]onmicrosoft[.]com
rkgfderwredu[.]onmicrosoft[.]com
rmconline[.]onmicrosoft[.]com
rongabam[.]onmicrosoft[.]com
rorjolaarojolo[.]onmicrosoft[.]com
rosita2007Yfb[.]onmicrosoft[.]com
rrthfdxhfdzhsfdhf[.]onmicrosoft[.]com
rtrhgftrehhg[.]onmicrosoft[.]com
rvueduin[.]onmicrosoft[.]com
s4okfa1sd8ikxel1gub0o5cl963[.]onmicrosoft[.]com
saaiidiaa[.]onmicrosoft[.]com
sabvfr7ea[.]onmicrosoft[.]com
sadikhngggfh[.]onmicrosoft[.]com
safehavenwildlifee[.]onmicrosoft[.]com
saiani[.]onmicrosoft[.]com
salamoalyukin[.]onmicrosoft[.]com
Salitomnhadxis[.]onmicrosoft[.]com
Sarneadvenosipsl[.]onmicrosoft[.]com
SCHOOLSDEFE[.]onmicrosoft[.]com
sddffsfsff[.]onmicrosoft[.]com
sdfgjg[.]onmicrosoft[.]com
sdfsagsdghsdgdsads[.]onmicrosoft[.]com
sdgvxcsfgxvccxvsdgfchsgbvcbfxcb[.]onmicrosoft[.]com
sdht[.]onmicrosoft[.]com
sdihrazem[.]onmicrosoft[.]com
sdn02winongohebat[.]onmicrosoft[.]com
sdn1sima[.]onmicrosoft[.]com
sdn1sumba[.]onmicrosoft[.]com
sdndemangsatu[.]onmicrosoft[.]com
sdnrejomulyo2smart[.]onmicrosoft[.]com
sdrfsfsfxsfxs[.]onmicrosoft[.]com
serftcrc[.]onmicrosoft[.]com
Sharontalikabotra1[.]onmicrosoft[.]com
SHOOLATIONBETAS[.]onmicrosoft[.]com
sikzefyde[.]onmicrosoft[.]com
sixstep0roundsxhoafeebnbl[.]onmicrosoft[.]com
skhinat[.]onmicrosoft[.]com
skpc0ntxntb8je58sqr[.]onmicrosoft[.]com
skypesksm[.]onmicrosoft[.]com
skyvictory[.]onmicrosoft[.]com
Slagterdmusj[.]onmicrosoft[.]com
slerfdggb[.]onmicrosoft[.]com
smakljsfdsv[.]onmicrosoft[.]com
smanegeri4madiun[.]onmicrosoft[.]com
smpn5kotamadiun[.]onmicrosoft[.]com
SNISTI[.]onmicrosoft[.]com
snnssmartact[.]onmicrosoft[.]com
sofrane[.]onmicrosoft[.]com
solareus[.]onmicrosoft[.]com
Solfriedzamreioqzpec[.]onmicrosoft[.]com
solomams[.]onmicrosoft[.]com
soltanika[.]onmicrosoft[.]com
souelinpelin[.]onmicrosoft[.]com
spboczow[.]onmicrosoft[.]com
speckvc[.]onmicrosoft[.]com
spomifozlxes[.]onmicrosoft[.]com
spothlpijlca[.]onmicrosoft[.]com
spufrabrusp[.]onmicrosoft[.]com
srbvrere[.]onmicrosoft[.]com
stacey025[.]onmicrosoft[.]com
stchrisnlvorg[.]onmicrosoft[.]com
stiswatotlx1d4it[.]onmicrosoft[.]com
stzu[.]onmicrosoft[.]com
supportjharkhand[.]onmicrosoft[.]com
Swasamsakhet[.]onmicrosoft[.]com
swojafutewr[.]onmicrosoft[.]com
t1chile[.]onmicrosoft[.]com
tabardda[.]onmicrosoft[.]com
tachlfonewl[.]onmicrosoft[.]com
tajosapintar[.]onmicrosoft[.]com
takhbout[.]onmicrosoft[.]com
talkhcha[.]onmicrosoft[.]com
tamaynout[.]onmicrosoft[.]com
tangermedd[.]onmicrosoft[.]com
TangierSchool[.]onmicrosoft[.]com
TanokamlPa[.]onmicrosoft[.]com
Tantondyali[.]onmicrosoft[.]com
taskaobnshhopffrm[.]onmicrosoft[.]com
tdyhsabatv[.]onmicrosoft[.]com
te915704543[.]onmicrosoft[.]com
teclive[.]onmicrosoft[.]com
TempestCorporation[.]onmicrosoft[.]com
TexasWomanssUniversity[.]onmicrosoft[.]com
thanhto97[.]onmicrosoft[.]com
thasp4vlw8dre3[.]onmicrosoft[.]com
thelaast[.]onmicrosoft[.]com
thequestlvv[.]onmicrosoft[.]com
thnhuhanh[.]onmicrosoft[.]com
THPTHaiBaTrung650[.]onmicrosoft[.]com
THPTNgoQuyen914[.]onmicrosoft[.]com
THPTNguyenThiMinhKhaii[.]onmicrosoft[.]com
THPTPhamNguLao414[.]onmicrosoft[.]com
THPTPhanChuTrinh530[.]onmicrosoft[.]com
thptthanglongg[.]onmicrosoft[.]com
tichimot[.]onmicrosoft[.]com
TijaniKamlaPower[.]onmicrosoft[.]com
tpthat[.]onmicrosoft[.]com
traviandola[.]onmicrosoft[.]com
tregfere[.]onmicrosoft[.]com
tresepeswoku[.]onmicrosoft[.]com
trizui[.]onmicrosoft[.]com
trufescqtwdxqdwjxka[.]onmicrosoft[.]com
ttawryit[.]onmicrosoft[.]com
ttslymn[.]onmicrosoft[.]com
ttuoyai403yrzdgwkoa54cc[.]onmicrosoft[.]com
Tuenancvjmxgepiyz[.]onmicrosoft[.]com
txi7lpup2gre44foz[.]onmicrosoft[.]com
tymtyiug[.]onmicrosoft[.]com
uhcl0[.]mail[.]onmicrosoft[.]com
uiowaedu[.]onmicrosoft[.]com
uke2pr25nkp821k3jl76k7hve[.]onmicrosoft[.]com
ukran659ia[.]onmicrosoft[.]com
Umbojgfsm[.]onmicrosoft[.]com
unej[.]onmicrosoft[.]com
universitasklabat[.]onmicrosoft[.]com
uopedupk[.]onmicrosoft[.]com
vdxm[.]onmicrosoft[.]com
vebelfetzeryeagsblxfmkh[.]onmicrosoft[.]com
veroty[.]onmicrosoft[.]com
vgsrtsdrtdsrszedfghiu[.]onmicrosoft[.]com
vmeb[.]onmicrosoft[.]com
vmlw[.]onmicrosoft[.]com
volman683[.]onmicrosoft[.]com
VolsDirect[.]onmicrosoft[.]com
vRn4c4XNkAJenniferx2tx2k4[.]onmicrosoft[.]com
vrtbgtryt[.]onmicrosoft[.]com
vslu[.]onmicrosoft[.]com
vuc9thicrexog6vlt[.]onmicrosoft[.]com
vunx[.]onmicrosoft[.]com
vyzdinisxskmevimvprn[.]onmicrosoft[.]com
watkinsod[.]onmicrosoft[.]com
webrupridrom[.]onmicrosoft[.]com
wejdahawiya[.]onmicrosoft[.]com
wilimoliro[.]onmicrosoft[.]com
wilyamkimo[.]onmicrosoft[.]com
worldeconomynrhoa[.]onmicrosoft[.]com
wostocrifru[.]onmicrosoft[.]com
wrobrocoged[.]onmicrosoft[.]com
wvbonxl[.]onmicrosoft[.]com
x0056xb[.]onmicrosoft[.]com
x09jykh[.]onmicrosoft[.]com
x0j93o6[.]onmicrosoft[.]com
x0qb7mu[.]onmicrosoft[.]com
x0r9au9[.]onmicrosoft[.]com
x0t7m4h[.]onmicrosoft[.]com
x12vdf6[.]onmicrosoft[.]com
x12x9k9[.]onmicrosoft[.]com
x1wg2y7[.]onmicrosoft[.]com
x203673[.]onmicrosoft[.]com
x274f7q[.]onmicrosoft[.]com
x289lb5[.]onmicrosoft[.]com
x2985tc[.]onmicrosoft[.]com
x2kg16f[.]onmicrosoft[.]com
x32974e[.]onmicrosoft[.]com
x3z8e1m[.]onmicrosoft[.]com
x4i4302[.]onmicrosoft[.]com
x4i4ztf[.]onmicrosoft[.]com
x4was2m[.]onmicrosoft[.]com
x55b604[.]onmicrosoft[.]com
x5jcild[.]onmicrosoft[.]com
x61ktlp[.]onmicrosoft[.]com
x62p9qh[.]onmicrosoft[.]com
x66tm4j[.]onmicrosoft[.]com
x686b0n[.]onmicrosoft[.]com
x6g4153[.]onmicrosoft[.]com
x6pjs76[.]onmicrosoft[.]com
x6tl4l3[.]onmicrosoft[.]com
x793409[.]onmicrosoft[.]com
x7ax5fg[.]onmicrosoft[.]com
x7tu336[.]onmicrosoft[.]com
x81x202[.]onmicrosoft[.]com
x82wu7f[.]onmicrosoft[.]com
x8674lj[.]onmicrosoft[.]com
x884518[.]onmicrosoft[.]com
x88kv2i[.]onmicrosoft[.]com
x8m6805[.]onmicrosoft[.]com
x91y24t[.]onmicrosoft[.]com
x97439g[.]onmicrosoft[.]com
x982369[.]onmicrosoft[.]com
x98qpls[.]onmicrosoft[.]com
x99jcxn[.]onmicrosoft[.]com
x9ecv3o[.]onmicrosoft[.]com
x9f0o0r[.]onmicrosoft[.]com
x9mqut3[.]onmicrosoft[.]com
x9n9vlm[.]onmicrosoft[.]com
x9oe1n6[.]onmicrosoft[.]com
x9pe13q[.]onmicrosoft[.]com
x9ua89q[.]onmicrosoft[.]com
xa03k9q[.]onmicrosoft[.]com
xa0x74g[.]onmicrosoft[.]com
xa332t8[.]onmicrosoft[.]com
xb5r038[.]onmicrosoft[.]com
xbncvyuewf[.]onmicrosoft[.]com
xbnx392[.]onmicrosoft[.]com
xc11026[.]onmicrosoft[.]com
xd71g1s[.]onmicrosoft[.]com
xdeeducation[.]onmicrosoft[.]com
xdeu[.]onmicrosoft[.]com
xfy63lh[.]onmicrosoft[.]com
xgi9676[.]onmicrosoft[.]com
xgy5l0a[.]onmicrosoft[.]com
xhb6g56[.]onmicrosoft[.]com
xi257d5[.]onmicrosoft[.]com
xinhuarxeszhhhizyxh[.]onmicrosoft[.]com
xj90kny[.]onmicrosoft[.]com
xjs0796[.]onmicrosoft[.]com
xk7o8d4[.]onmicrosoft[.]com
xl18o4n[.]onmicrosoft[.]com
xlue6y1[.]onmicrosoft[.]com
xm4r626[.]onmicrosoft[.]com
xmaktahdw[.]onmicrosoft[.]com
xmwsk1j[.]onmicrosoft[.]com
xn3b57u[.]onmicrosoft[.]com
xni5821[.]onmicrosoft[.]com
xo4wks0[.]onmicrosoft[.]com
xo786d3[.]onmicrosoft[.]com
xoha63j[.]onmicrosoft[.]com
xomltusocre[.]onmicrosoft[.]com
xp9l5pi[.]onmicrosoft[.]com
xpg9sg8[.]onmicrosoft[.]com
xqccoe4[.]onmicrosoft[.]com
xrkx1hm[.]onmicrosoft[.]com
xrt242t[.]onmicrosoft[.]com
xtgy1d7[.]onmicrosoft[.]com
xtheclosetsjsdjddyuznn[.]onmicrosoft[.]com
xxpq9k4[.]onmicrosoft[.]com
xxti136[.]onmicrosoft[.]com
xy10492[.]onmicrosoft[.]com
xywe660[.]onmicrosoft[.]com
xz093p6[.]onmicrosoft[.]com
xzfj068[.]onmicrosoft[.]com
Yadrimpoltion[.]onmicrosoft[.]com
Yankipankilalo[.]onmicrosoft[.]com
YedekFihbzaf[.]onmicrosoft[.]com
yivuzojumogopro[.]onmicrosoft[.]com
yohanlima[.]onmicrosoft[.]com
yorikakaamyoriii[.]onmicrosoft[.]com
youssman[.]onmicrosoft[.]com
yousssef[.]onmicrosoft[.]com
Yowami[.]onmicrosoft[.]com
Ysibaklamahibak[.]onmicrosoft[.]com
yupoo[.]onmicrosoft[.]com
yyfxhgsdwgs20[.]onmicrosoft[.]com
zahgb[.]onmicrosoft[.]com
zavetrinutjtyz[.]onmicrosoft[.]com
zbijzhzjzhzjzjzhzdz[.]onmicrosoft[.]com
zbikdjdksdkskdjedfef[.]onmicrosoft[.]com
zbmxs[.]onmicrosoft[.]com
zefrefregre[.]onmicrosoft[.]com
zihlficroph[.]onmicrosoft[.]com
zomzaaam[.]onmicrosoft[.]com