Microsoft Exchange ECP Probe (ProxyShell / ProxyLogon) for 2026-10-20
Last Updated: 00:00 UTC
The Exchange Control Panel (/ecp/) is the attack surface for ProxyLogon (CVE-2021-26855) and ProxyShell (CVE-2021-34473/34523/31207). Both exploit chains begin with ECP requests and achieve unauthenticated RCE leading to ASPX webshell deployment on the Exchange server.
CVE References
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| United States | 23 | 26.7% |
| Germany | 23 | 26.7% |
| Canada | 11 | 12.8% |
| United Kingdom | 8 | 9.3% |
| The Netherlands | 8 | 9.3% |
| Singapore | 7 | 8.1% |
| India | 4 | 4.7% |
| Japan | 2 | 2.3% |
IP Address : ASN : City/Provider
-
104.237.130.38 : AS63949 Akamai Connected Cloud : Richardson
-
128.199.182.152 : AS14061 DigitalOcean, LLC : Singapore
-
128.199.182.55 : AS14061 DigitalOcean, LLC : Singapore
-
128.199.182.77 : AS14061 DigitalOcean, LLC : Singapore
-
134.122.28.88 : AS14061 DigitalOcean, LLC : North Bergen
-
134.33.66.210 : AS8075 Microsoft Corporation : Phoenix
-
138.197.191.87 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
138.68.144.227 : AS14061 DigitalOcean, LLC : Slough
-
138.68.82.23 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
138.68.86.32 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
139.162.210.205 : AS63949 Akamai Connected Cloud : London
-
139.162.96.14 : AS63949 Akamai Connected Cloud : Tokyo
-
139.59.132.8 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
139.59.136.184 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
139.59.143.102 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
139.59.231.238 : AS14061 DigitalOcean, LLC : Singapore
-
142.93.0.66 : AS14061 DigitalOcean, LLC : North Bergen
-
142.93.129.190 : AS14061 DigitalOcean, LLC : Amsterdam
-
142.93.143.8 : AS14061 DigitalOcean, LLC : Amsterdam
-
143.110.213.72 : AS14061 DigitalOcean, LLC : Toronto
-
143.110.217.244 : AS14061 DigitalOcean, LLC : Toronto
-
143.244.168.161 : AS14061 DigitalOcean, LLC : North Bergen
-
146.190.242.161 : AS14061 DigitalOcean, LLC : Toronto
-
146.190.63.248 : AS14061 DigitalOcean, LLC : Santa Clara
-
146.190.63.48 : AS14061 DigitalOcean, LLC : Santa Clara
-
147.182.149.75 : AS14061 DigitalOcean, LLC : Toronto
-
147.182.200.94 : AS14061 DigitalOcean, LLC : Santa Clara
-
157.230.19.140 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
157.245.105.107 : AS14061 DigitalOcean, LLC : Bengaluru
-
157.245.204.205 : AS14061 DigitalOcean, LLC : Singapore
-
157.245.36.108 : AS14061 DigitalOcean, LLC : Slough
-
159.203.96.42 : AS14061 DigitalOcean, LLC : Clifton
-
159.223.132.86 : AS14061 DigitalOcean, LLC : North Bergen
-
159.65.144.72 : AS14061 DigitalOcean, LLC : Bengaluru
-
159.65.18.197 : AS14061 DigitalOcean, LLC : Slough
-
159.89.12.166 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
159.89.127.165 : AS14061 DigitalOcean, LLC : Toronto
-
159.89.17.243 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
159.89.174.87 : AS14061 DigitalOcean, LLC : Bengaluru
-
164.90.208.56 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
164.90.228.79 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
164.92.107.174 : AS14061 DigitalOcean, LLC : Santa Clara
-
164.92.244.132 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
165.22.235.3 : AS14061 DigitalOcean, LLC : Toronto
-
165.22.34.189 : AS14061 DigitalOcean, LLC : Clifton
-
165.227.173.41 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
165.227.39.235 : AS14061 DigitalOcean, LLC : Toronto
-
167.172.158.128 : AS14061 DigitalOcean, LLC : North Bergen
-
167.172.232.142 : AS14061 DigitalOcean, LLC : Clifton
-
167.71.175.236 : AS14061 DigitalOcean, LLC : Clifton
-
167.71.81.114 : AS14061 DigitalOcean, LLC : Clifton
-
167.99.181.249 : AS14061 DigitalOcean, LLC : Toronto
-
167.99.182.39 : AS14061 DigitalOcean, LLC : Toronto
-
167.99.210.137 : AS14061 DigitalOcean, LLC : Amsterdam
-
172.105.158.219 : AS63949 Akamai Connected Cloud : Atlanta
-
172.105.16.131 : AS63949 Akamai Connected Cloud : Toronto
-
172.105.16.40 : AS63949 Akamai Connected Cloud : Toronto
-
172.105.197.17 : AS63949 Akamai Connected Cloud : Tokyo
-
178.128.207.138 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
188.166.108.93 : AS14061 DigitalOcean, LLC : Amsterdam
-
192.46.211.230 : AS63949 Akamai Connected Cloud : Mumbai
-
206.189.19.19 : AS14061 DigitalOcean, LLC : Slough
-
206.189.2.13 : AS14061 DigitalOcean, LLC : Amsterdam
-
206.189.225.181 : AS14061 DigitalOcean, LLC : North Bergen
-
206.189.233.36 : AS14061 DigitalOcean, LLC : North Bergen
-
206.189.95.232 : AS14061 DigitalOcean, LLC : Singapore
-
206.81.12.187 : AS14061 DigitalOcean, LLC : North Bergen
-
206.81.24.227 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
206.81.24.74 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
207.154.197.113 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
207.154.212.47 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
209.38.208.202 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
209.38.248.17 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
209.97.180.8 : AS14061 DigitalOcean, LLC : Slough
-
46.101.1.225 : AS14061 DigitalOcean, LLC : Slough
-
46.101.111.185 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
64.225.75.246 : AS14061 DigitalOcean, LLC : Amsterdam
-
64.226.65.160 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
64.226.78.121 : AS14061 DigitalOcean, LLC : Frankfurt am Main
-
64.227.32.66 : AS14061 DigitalOcean, LLC : Slough
-
64.227.70.2 : AS14061 DigitalOcean, LLC : Amsterdam
-
64.23.218.208 : AS14061 DigitalOcean, LLC : Santa Clara
-
68.183.180.73 : AS14061 DigitalOcean, LLC : Singapore
-
68.183.9.16 : AS14061 DigitalOcean, LLC : Amsterdam
-
96.126.110.181 : AS63949 Akamai Connected Cloud : Cedar Knolls
-
96.126.110.54 : AS63949 Akamai Connected Cloud : Cedar Knolls