{"cve_id":"CVE-2019-9621","title":"Zimbra Collaboration Suite - SSRF","severity":"high","actively_exploited":true,"patterns":["/autodiscover"],"events":218,"unique_ips":143,"actors":[{"ip":"32.193.171.199","events":24,"country_code":"US","country":"United States","org":"Amazon.com, Inc.","rdns":"scan.strongwind.dev","scanner_tag":null},{"ip":"185.93.89.43","events":12,"country_code":"IR","country":"Iran","org":"Limited Network LTD","rdns":"","scanner_tag":null},{"ip":"100.48.18.224","events":12,"country_code":"US","country":"United States","org":"Amazon.com, Inc.","rdns":"ec2-100-48-18-224.compute-1.amazonaws.com","scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"}},{"ip":"179.43.186.241","events":6,"country_code":"CH","country":"Switzerland","org":"Private Layer INC","rdns":"hostedby.privatelayer.com","scanner_tag":null},{"ip":"74.249.104.193","events":6,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"20.17.96.244","events":4,"country_code":"MY","country":"Malaysia","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"101.36.125.58","events":4,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"179.43.163.26","events":3,"country_code":"CH","country":"Switzerland","org":"Private Layer INC","rdns":"hosted-by.privatelayer.com","scanner_tag":null},{"ip":"79.124.40.174","events":3,"country_code":"BG","country":"Bulgaria","org":"Tamatiya EOOD","rdns":"ip-40-174.4vendeta.com","scanner_tag":null},{"ip":"13.89.124.216","events":3,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcslejnig.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.14.73.198","events":2,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdwswmnwt7.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.163.38.129","events":2,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdws65gd2r.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.192.67","events":2,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssfmudnd.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"31.59.160.3","events":2,"country_code":"AE","country":"United Arab Emirates","org":"Miteflux Technologies Ltd","rdns":"","scanner_tag":null},{"ip":"20.84.153.185","events":2,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcsquufja.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"185.177.72.23","events":2,"country_code":"FR","country":"France","org":"Bucklog SARL","rdns":"","scanner_tag":null},{"ip":"128.203.200.216","events":2,"country_code":"GB","country":"United Kingdom","org":"Microsoft Corporation","rdns":"azpdcg90igxg.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.193.152","events":2,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdss4ht8in.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.194.167","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssgew5fb.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"40.124.175.164","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsgks4vhl.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.64.96.205","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssmmbpn3.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"135.237.125.27","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdesgq7s07.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.195.46","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdss50zj96.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.194.61","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsss5fjwq.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.194.162","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssoq3ffq.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.118.216.53","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcg9xzbm5.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.194.58","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssezu9hk.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.15.164.165","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcgqw0sth.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"135.237.126.127","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdes63bdu5.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.14.78.253","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdwsse59c1.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.163.15.177","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdws0c9gtk.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.192.66","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssje5f81.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.14.73.62","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdws46kxr4.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"172.174.200.225","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdeswwp3va.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"40.124.173.16","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsgp9y705.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.201.12","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssyzibct.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"130.131.161.76","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcgs7d080.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"172.212.200.195","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcshviaa8.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.169.53.8","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdws6ablyw.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.154.237","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsgjf6qkj.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"52.146.21.82","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdes6iyb36.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.163.15.19","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdwsg0x1sz.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"74.249.128.217","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcgnzamvp.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.221.72.241","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcsg4x480.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"40.80.201.49","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdss8q0cgn.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.83.48.204","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcgx4zkbc.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.163.15.107","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdws6b5q5j.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.46.251.132","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdcg2o59ep.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.185.115","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdsgbmp5gp.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}},{"ip":"20.65.193.206","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"azpdssy2j4f1.stretchoid.com","scanner_tag":{"key":"stretchoid","label":"Stretchoid","category":"commercial","url":"https://stretchoid.com"}}],"top_asns":[{"asn":8075,"org":"Microsoft Corporation","events":149,"ips":133},{"asn":14618,"org":"Amazon.com, Inc.","events":36,"ips":2},{"asn":213790,"org":"Limited Network LTD","events":12,"ips":1},{"asn":51852,"org":"Private Layer INC","events":9,"ips":2},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":4,"ips":1},{"asn":50360,"org":"Tamatiya EOOD","events":3,"ips":1},{"asn":211590,"org":"Bucklog SARL","events":2,"ips":1},{"asn":203861,"org":"Miteflux Technologies Ltd","events":2,"ips":1},{"asn":9009,"org":"M247 Europe SRL","events":1,"ips":1}],"fingerprints":{"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn14en_068ebe3632ec","ge11nn0400_91d9e55fb80a","ge11nn06en_35b65d0b464f","ge11nn0400_9c3956fad5da","ge11nn05en_813e32c09d15"],"ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i4311h1_c7886603b240_b26ce05bbdd6","t13i130900_f57a46bbacb6_e7c285222651","t13i251000_b78ed14e2fd0_ab7e3b40a677","t13i100800_61a7ad8aa9b6_d268365384ff"]},"sample_paths":["/autodiscover/autodiscover.json?@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com","/autodiscover/","/Autodiscover/AutodiscoverService.svc/root","/autodiscover/autodiscover.json?@zdi/Powershell","/autodiscover","/autodiscover/autodiscover.json?@test.com/mapi/emsmdb?&Email=autodiscover/autodiscover.json%3F@test.com","/autodiscover/autodiscover.json?@test.com/mapi/nspi/?&Email=autodiscover/autodiscover.json%3F@test.com","/autodiscover/autodiscover.json","/autodiscover/autodiscover.xml/","/autodiscover/autodiscover.xml"],"timeline":[{"day":"2026-05-02","events":12,"ips":1},{"day":"2026-05-04","events":2,"ips":1},{"day":"2026-05-05","events":1,"ips":1},{"day":"2026-05-06","events":2,"ips":2},{"day":"2026-05-08","events":1,"ips":1},{"day":"2026-05-09","events":3,"ips":3},{"day":"2026-05-11","events":6,"ips":5},{"day":"2026-05-12","events":7,"ips":2},{"day":"2026-05-13","events":4,"ips":4},{"day":"2026-05-14","events":2,"ips":1},{"day":"2026-05-15","events":8,"ips":5},{"day":"2026-05-17","events":5,"ips":4},{"day":"2026-05-19","events":3,"ips":3},{"day":"2026-05-22","events":2,"ips":2},{"day":"2026-05-24","events":3,"ips":3},{"day":"2026-05-26","events":2,"ips":2},{"day":"2026-05-28","events":4,"ips":4},{"day":"2026-05-31","events":4,"ips":4},{"day":"2026-06-02","events":4,"ips":4},{"day":"2026-06-04","events":4,"ips":4},{"day":"2026-06-06","events":3,"ips":3},{"day":"2026-06-08","events":3,"ips":3},{"day":"2026-06-10","events":3,"ips":3},{"day":"2026-06-11","events":2,"ips":2},{"day":"2026-06-13","events":4,"ips":4},{"day":"2026-06-15","events":5,"ips":4},{"day":"2026-06-17","events":4,"ips":4},{"day":"2026-06-19","events":4,"ips":4},{"day":"2026-06-21","events":1,"ips":1},{"day":"2026-06-22","events":4,"ips":4},{"day":"2026-06-24","events":3,"ips":3},{"day":"2026-06-26","events":4,"ips":4},{"day":"2026-06-28","events":4,"ips":4},{"day":"2026-07-01","events":4,"ips":4},{"day":"2026-07-02","events":1,"ips":1},{"day":"2026-07-03","events":4,"ips":4},{"day":"2026-07-04","events":1,"ips":1},{"day":"2026-07-05","events":5,"ips":5},{"day":"2026-07-06","events":1,"ips":1},{"day":"2026-07-07","events":4,"ips":4},{"day":"2026-07-09","events":2,"ips":1},{"day":"2026-07-10","events":4,"ips":4},{"day":"2026-07-12","events":4,"ips":4},{"day":"2026-07-14","events":4,"ips":4},{"day":"2026-07-15","events":2,"ips":1},{"day":"2026-07-16","events":3,"ips":3},{"day":"2026-07-19","events":4,"ips":4},{"day":"2026-07-20","events":1,"ips":1},{"day":"2026-07-21","events":4,"ips":4},{"day":"2026-07-23","events":4,"ips":4},{"day":"2026-07-25","events":13,"ips":2},{"day":"2026-07-26","events":2,"ips":2},{"day":"2026-07-27","events":24,"ips":1},{"day":"2026-07-28","events":4,"ips":4}],"window_hours":2160}