Referer-Header Reflected XSS — res127.storeemail.microsoft.com

payload rides in this page URL path, sent as Referer to the iframe below: