outlook.live.com

is this an email link?

[Wayder]

Hi,

Once again I find myself a little confused.

Would a referer of https://outlook.live.com/ indicate a link from an email?

Thank you

[edited by: phranque at 4:29 am (utc) on Jul 22, 2023]
[edit reason] unlinked url for clarity [/edit]

[not2easy]

If your logs show a single entry showing a referer from outlook live, and then proceeds to show entries loading resources for the page/pages that a human would get on a visit, it is not impossible it might be from an email. That means the log entries show them retrieving images, css and scripts for the page/s viewed. But in general, most referers shown in logs are not human. Rather than relying on referer are they showing some unusual UA?

[Wayder]

No. Two IPs, both take one page including assets which is normal.

I 403 most everything but the visitors I wish and log them. Occasionally find something which seem extra ordinary that gets through so I try to research it but I could only find one result on this.

Headers:

Host: example.com
upgrade-insecure-requests: 1
dnt: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
X-HTTPS: 1

and

Host: example.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9
X-HTTPS: 1

These are the only visits for these two IPs and both had the outlook referer. The second doesn't have the sec-fetch fields which is why it piqued my curiosity and to me they are making all the right noises so I thought I would ask the question.

Sorry about the original link.

Thanks

[lucy24]

Do you yourself use Ourlook, or know someone who does? If so, you can easily test it by sending a link in email, clicking at some prearranged time, and checking your logs to see what the referer looks like.

[Wayder]

Unfortunately I don't but I will ask around.

Good suggestion. Thanks