193.26.115[.]16IP address

“We recorded sign-ins through the Microsoft Office device-code flow from 193.26.115[.]16, where the victim is tricked into entering a code on Microsoft's legitimate sign-in page and directly hands and attacker a valid refresh and access token, unknowingly authorizing the attacker's…”