ghostsmtp.com Open in urlscan Pro
2606:4700:3034::6818:6398  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set login.php Show response ghostsmtp.com/email-list/officenewnew/	27 KB 9 KB	2586ms 2571ms	Document text/html	2606:4700:3034::6818:6398 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://ghostsmtp.com/email-list/officenewnew/login.php Protocol HTTP/1.1 Server 2606:4700:3034::6818:6398 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 472b120b68cbfcfdf9a2a0ab41c0d653c1e7e816bae3085d8fed55ffbc230774 Request headers Host ghostsmtp.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 18 May 2020 16:38:03 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=de6ed93db19c5e7e684312043c85acad31589819880; expires=Wed, 17-Jun-20 16:38:00 GMT; path=/; domain=.ghostsmtp.com; HttpOnly; SameSite=Lax Vary Accept-Encoding CF-Cache-Status DYNAMIC Server cloudflare CF-RAY 5957018e589e96bc-FRA Content-Encoding gzip cf-request-id 02ca3f4cf3000096bcc73da200000001
GET H2	200	converged.v2.login.min_bxeixgi3llnj-nuc4-xqwa2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	98 KB 19 KB	880ms 33ms	Stylesheet text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_bxeixgi3llnj-nuc4-xqwa2.css Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F772) / Resource Hash 21cc48423ee47207382cc9c1c3885913079be17805e6ff81e76e0e7165ca32cd Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://ghostsmtp.com/email-list/officenewnew/login.php Origin http://ghostsmtp.com Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-encoding gzip content-md5 /QTIvWAmch1jyMIGqgKwLw== age 4511137 x-cache HIT status 200 content-length 18549 x-ms-lease-status unlocked last-modified Sat, 18 May 2019 01:23:39 GMT server ECAcc (ska/F772) etag 0x8D6DB2F75734207 vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 9d73039a-501e-008f-592b-041923000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	555 KB 144 KB	916ms 69ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_4myuo72mlhdkjc9hn1du5g2.js Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6E7) / Resource Hash d35725073bba404de01fb101757d1eae3a7f08346f44d56e671ae59930c046b6 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://ghostsmtp.com/email-list/officenewnew/login.php Origin http://ghostsmtp.com Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-encoding gzip content-md5 pCZto1Uv5dyg9kd9tydtWA== age 10186725 x-cache HIT status 200 content-length 146875 x-ms-lease-status unlocked last-modified Fri, 31 May 2019 03:41:27 GMT server ECAcc (ska/F6E7) etag 0x8D6E579DCDC340B vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id cb759e9c-d01e-008c-548c-d0ea43000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en.min_veg9zg4gq7m3vyno9nzqga2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	31 KB 10 KB	907ms 60ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_veg9zg4gq7m3vyno9nzqga2.js Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F7B4) / Resource Hash 018a144e28538b05538acee6936f56c65bf0dc35adabb29914e252506968f207 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://ghostsmtp.com/email-list/officenewnew/login.php Origin http://ghostsmtp.com Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-encoding gzip content-md5 U1n25vMNIGp66ek1ktkRiQ== age 10186725 x-cache HIT status 200 content-length 10161 x-ms-lease-status unlocked last-modified Fri, 24 May 2019 04:18:28 GMT server ECAcc (ska/F7B4) etag 0x8D6DFFEDFCFDF3D vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 66216108-c01e-004f-438c-d01dc4000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/ests/2.1/content/images/	4 KB 2 KB	125ms 32ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F695) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer http://ghostsmtp.com/email-list/officenewnew/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 161728 x-cache HIT status 200 content-length 1435 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:22 GMT server ECAcc (ska/F695) etag 0x8D64101507E84BD vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 80bc7b1d-401e-0028-1eba-2b87fb000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg aadcdn.msftauth.net/ests/2.1/content/images/	915 B 414 B	63ms 33ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6B0) / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer http://ghostsmtp.com/email-list/officenewnew/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-encoding gzip content-md5 HMwsHhNXdtrfirQDkzcqMA== age 115179 x-cache HIT status 200 content-length 263 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:15 GMT server ECAcc (ska/F6B0) etag 0x8D641014CC1CD9F vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 08295565-d01e-0064-6426-2cb7da000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg aadcdn.msftauth.net/ests/2.1/content/images/	915 B 413 B	36ms 32ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6A7) / Resource Hash 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6 Request headers Referer http://ghostsmtp.com/email-list/officenewnew/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-encoding gzip content-md5 /a3y/mpA+HRaVAiPACrsog== age 339560 x-cache HIT status 200 content-length 263 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:14 GMT server ECAcc (ska/F6A7) etag 0x8D641014C1EFD89 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 9b3d98e2-301e-0099-431c-2a40ca000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	Me.htm login.live.com/ Frame FD2B	0 0	457ms 151ms	Document text/html	40.90.23.153 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=1 Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.90.23.153 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority login.live.com :scheme https :path /Me.htm?v=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://ghostsmtp.com/email-list/officenewnew/login.php accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://ghostsmtp.com/email-list/officenewnew/login.php Response headers status 200 cache-control max-age=315360000 content-type text/html; charset=utf-8 content-encoding gzip expires Thu, 16 May 2030 16:38:04 GMT vary Accept-Encoding server Microsoft-IIS/10.0 p3p CP="DSP CUR OTPi IND OTRi ONL FIN" set-cookie uaid=2664ce7e9aeb4b4a916b20240d54269c; domain=login.live.com; Secure; path=/; HttpOnly MSPRequ=id=N&lt=1589819884&co=1; domain=login.live.com; Secure; path=/; HttpOnly referrer-policy strict-origin-when-cross-origin x-ms-request-id bb1261da-9691-4f46-8219-57fece085064 ppserver PPV: 30 H: BL02PFB66E550DF V: 0 x-content-type-options nosniff strict-transport-security max-age=31536000 x-xss-protection 1; mode=block date Mon, 18 May 2020 16:38:03 GMT content-length 1132
GET H2	200	prefetch www.office.com/prefetch/ Frame 5712	0 0	79ms 35ms	Document text/html	2620:1ec:a92::156 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.office.com/prefetch/prefetch Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:a92::156 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.office.com :scheme https :path /prefetch/prefetch pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer http://ghostsmtp.com/email-list/officenewnew/login.php accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://ghostsmtp.com/email-list/officenewnew/login.php Response headers status 200 cache-control no-store,no-cache pragma no-cache content-type text/html; charset=utf-8 content-encoding gzip vary Accept-Encoding set-cookie OH.SID=f52da6ef-3892-4f40-ac34-c46952935ab1; path=/; samesite=none; secure; httponly OH.DCAffinity=OH-weu; path=/; samesite=none; secure; httponly MUID=024D803E14576EAF02BB8EF0152C6F4B; path=/; secure; expires=Sat, 12-Jun-2021 16:38:04 GMT; domain=office.com strict-transport-security max-age=31536000; includeSubDomains referrer-policy strict-origin-when-cross-origin x-content-type-options nosniff x-xss-protection 1; mode=block x-ua-compatible IE=edge,chrome=1 x-msedge-ref Ref A: BA73E8268BF34AD49D7424A91DEB2097 Ref B: AM3EDGE0120 Ref C: 2020-05-18T16:38:04Z date Mon, 18 May 2020 16:38:04 GMT
GET H2	200	0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/	3 KB 3 KB	33ms 32ms	Image image/jpeg	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F7B7) / Resource Hash f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea Request headers Referer http://ghostsmtp.com/email-list/officenewnew/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-md5 E4vO5iT6BO+bdehiEan+DQ== age 246203 x-cache HIT status 200 content-length 3006 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:26:15 GMT server ECAcc (ska/F7B7) etag 0x8D64101700C3AB4 content-type image/jpeg access-control-allow-origin * x-ms-request-id cb191084-701e-009b-25f5-2a4da7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/	277 KB 277 KB	33ms 32ms	Image image/jpeg	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg Requested by Host: ghostsmtp.com URL: http://ghostsmtp.com/email-list/officenewnew/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F6D4) / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer http://ghostsmtp.com/email-list/officenewnew/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 18 May 2020 16:38:04 GMT content-md5 pdvUOT/2pyXH5ith335y8A== age 360629 x-cache HIT status 200 content-length 283351 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:26:15 GMT server ECAcc (ska/F6D4) etag 0x8D64101702F5B97 content-type image/jpeg access-control-allow-origin * x-ms-request-id 6224498f-f01e-0014-2ceb-298a01000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19 accept-ranges bytes

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| webpackJsonp object| StringRepository object| PROOF boolean| __

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			outlook.office365.com/	1970-01-19 14:01:57	Name: OIDC Value: 1
			.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1589819884&co=1
			www.office.com/	1969-12-31 23:59:59	Name: OH.DCAffinity Value: OH-weu
			outlook.office365.com/	1970-01-19 18:22:35	Name: ClientId Value: 95E49EC7CC6B4FF5A42498301E4257A1
			.office.com/	1970-01-19 18:58:35	Name: MUID Value: 024D803E14576EAF02BB8EF0152C6F4B
			www.office.com/	1969-12-31 23:59:59	Name: OH.SID Value: f52da6ef-3892-4f40-ac34-c46952935ab1
			.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 2664ce7e9aeb4b4a916b20240d54269c
			.ghostsmtp.com/	1970-01-19 10:20:11	Name: __cfduid Value: de6ed93db19c5e7e684312043c85acad31589819880

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
ghostsmtp.com
login.live.com
www.office.com
152.199.23.37
2606:4700:3034::6818:6398
2620:1ec:a92::156
40.90.23.153
018a144e28538b05538acee6936f56c65bf0dc35adabb29914e252506968f207
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
21cc48423ee47207382cc9c1c3885913079be17805e6ff81e76e0e7165ca32cd
472b120b68cbfcfdf9a2a0ab41c0d653c1e7e816bae3085d8fed55ffbc230774
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
d35725073bba404de01fb101757d1eae3a7f08346f44d56e671ae59930c046b6
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea