{"cve_id":"CVE-2021-34473","title":"Exchange Server - Remote Code Execution","severity":"critical","actively_exploited":true,"patterns":["/autodiscover/autodiscover.json"],"events":15,"unique_ips":15,"actors":[{"ip":"172.202.118.23","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcscjqp47.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.65.192.67","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssfmudnd.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.14.75.6","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdwsgje2x4.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.14.73.238","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdwspt8ldc.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.65.194.99","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdss0rcipx.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"40.124.172.78","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdss53vk31.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.65.193.206","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssy2j4f1.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.83.167.30","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdeskbkt6n.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"135.237.123.254","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdesgf2q5j.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.46.251.132","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcg2o59ep.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.84.153.185","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcsquufja.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.127.224.63","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdespk2by2.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.121.46.95","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdesgg8ot1.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.14.73.62","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdws46kxr4.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}},{"ip":"20.65.195.17","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssb2b8ir.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"research","url":"https://www.stretchoid.com/"}}],"top_asns":[{"asn":8075,"org":"Microsoft Corporation","events":15,"ips":15}],"fingerprints":{"ja4h":["ge11nn0400_88d30a62b7ad"],"ja4":["t12i130500_2d7513195f68_e51b7354d87f"]},"sample_paths":["/autodiscover/autodiscover.json?@zdi/Powershell"],"timeline":[{"day":"2026-06-24","events":3,"ips":3},{"day":"2026-06-26","events":4,"ips":4},{"day":"2026-06-28","events":4,"ips":4},{"day":"2026-07-01","events":4,"ips":4}],"window_hours":168}