Microsoft Exchange Autodiscover Credential Harvest for 2026-10-19
Last Updated: 00:00 UTC
Requests to /Autodiscover/Autodiscover.xml harvest Exchange credentials from Outlook clients that auto-negotiate mail settings. Any host responding to this path can capture NTLM or Basic auth credentials. Also used in ProxyLogon reconnaissance.
CVE References
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1114.002 — Remote Email Collection
Observed URIs
Attackers by Country
| Russia | 13 | 54.2% |
| Hong Kong | 3 | 12.5% |
| Sweden | 3 | 12.5% |
| Australia | 1 | 4.2% |
| Panama | 1 | 4.2% |
| South Africa | 1 | 4.2% |
| United Kingdom | 1 | 4.2% |
| Bulgaria | 1 | 4.2% |
IP Address : ASN : City/Provider
-
104.156.233.134 : AS20473 The Constant Company, LLC : Sydney
-
141.98.82.26 : AS209588 Flyservers S.A. : Panama
-
152.89.196.144 : AS208677 Cloud.ru : Russia
-
152.89.196.211 : AS208677 Cloud.ru : Russia
-
152.89.196.222 : AS208677 Cloud.ru : Russia
-
152.89.196.54 : AS208677 Cloud.ru : Russia
-
152.89.196.62 : AS208677 Cloud.ru : Russia
-
185.196.9.61 : unknown : unknown
-
185.7.214.104 : unknown : Hong Kong
-
185.7.214.117 : unknown : Hong Kong
-
192.142.226.23 : AS399138 Microlink Network : South Africa
-
193.106.191.48 : unknown : Krasnoyarsk
-
193.106.191.95 : unknown : Krasnoyarsk
-
198.167.197.162 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.194 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.204 : AS39287 Materialism s.r.l. : Sweden
-
213.109.202.66 : AS35278 Sprinthost.ru LLC : Akuray
-
213.226.123.30 : AS196695 NetOne Rus JSC : Moscow
-
45.146.164.110 : AS198610 Beget LLC : St Petersburg
-
45.146.165.37 : AS198610 Beget LLC : St Petersburg
-
45.155.204.146 : AS208677 Cloud.ru : Russia
-
45.155.205.233 : AS208677 Cloud.ru : St Petersburg
-
45.9.20.101 : AS212109 Squirrel Internet Ltd : United Kingdom
-
79.124.58.198 : AS50360 Tamatiya EOOD : Bulgaria
-
83.97.73.87 : unknown : unknown
-
83.97.73.89 : unknown : unknown
-
92.255.57.58 : unknown : Hong Kong