{"cve_id":"CVE-2021-26855","title":"Microsoft Exchange Server SSRF Vulnerability","severity":"critical","actively_exploited":true,"patterns":["/owa/auth/x.js"],"events":110,"unique_ips":14,"actors":[{"ip":"20.172.67.176","events":12,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdweiqxqd8.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"135.237.127.54","events":11,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdeebghd4z.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"172.203.234.251","events":11,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdeeru93yc.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.168.0.218","events":10,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdwes133xm.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.193.168","events":9,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsekvq0g7.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"48.217.87.78","events":9,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdeese2qqv.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.98.140.180","events":9,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdceoc78r8.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"172.202.117.213","events":9,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcexdg7i9.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"40.119.24.130","events":8,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsetn9tic.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.169.85.114","events":7,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdweq95i0h.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.193.203","events":7,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdseq81sxa.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.221.71.226","events":5,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcetl7xvx.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"101.36.125.58","events":2,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"31.59.160.3","events":1,"country_code":"AE","country":"United Arab Emirates","org":"Miteflux Technologies Ltd","rdns":"","scanner_tag":null}],"top_asns":[{"asn":8075,"org":"Microsoft Corporation","events":107,"ips":12},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":2,"ips":1},{"asn":203861,"org":"Miteflux Technologies Ltd","events":1,"ips":1}],"fingerprints":{"ja4h":["ge11cn0400_b88142ee38d4","ge11cn0400_f49c2c4a715a","ge11cn0300_df70c3f63f2d"],"ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i251000_b78ed14e2fd0_ab7e3b40a677","t13i190800_9dc949149365_97f8aa674fd9","t13i250900_b78ed14e2fd0_e7c285222651"]},"sample_paths":["/owa/auth/x.js"],"timeline":[{"day":"2026-04-29","events":2,"ips":2},{"day":"2026-05-15","events":2,"ips":1},{"day":"2026-05-19","events":2,"ips":1},{"day":"2026-05-21","events":3,"ips":3},{"day":"2026-05-23","events":3,"ips":3},{"day":"2026-05-26","events":3,"ips":3},{"day":"2026-05-29","events":4,"ips":4},{"day":"2026-05-31","events":3,"ips":3},{"day":"2026-06-01","events":1,"ips":1},{"day":"2026-06-03","events":4,"ips":4},{"day":"2026-06-05","events":4,"ips":3},{"day":"2026-06-08","events":3,"ips":2},{"day":"2026-06-11","events":4,"ips":4},{"day":"2026-06-13","events":2,"ips":1},{"day":"2026-06-14","events":2,"ips":2},{"day":"2026-06-16","events":2,"ips":2},{"day":"2026-06-17","events":1,"ips":1},{"day":"2026-06-19","events":4,"ips":3},{"day":"2026-06-22","events":4,"ips":3},{"day":"2026-06-24","events":4,"ips":4},{"day":"2026-06-27","events":3,"ips":3},{"day":"2026-06-30","events":4,"ips":3},{"day":"2026-07-02","events":3,"ips":3},{"day":"2026-07-04","events":1,"ips":1},{"day":"2026-07-05","events":3,"ips":3},{"day":"2026-07-07","events":2,"ips":2},{"day":"2026-07-08","events":2,"ips":2},{"day":"2026-07-09","events":3,"ips":3},{"day":"2026-07-10","events":1,"ips":1},{"day":"2026-07-11","events":4,"ips":3},{"day":"2026-07-13","events":2,"ips":2},{"day":"2026-07-14","events":1,"ips":1},{"day":"2026-07-15","events":4,"ips":3},{"day":"2026-07-17","events":2,"ips":2},{"day":"2026-07-18","events":2,"ips":2},{"day":"2026-07-20","events":4,"ips":4},{"day":"2026-07-22","events":4,"ips":3},{"day":"2026-07-24","events":1,"ips":1},{"day":"2026-07-25","events":3,"ips":3},{"day":"2026-07-27","events":4,"ips":4}],"window_hours":2160}