{"cve_id":"CVE-2019-9670","title":"Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection","severity":"critical","actively_exploited":true,"patterns":["/Autodiscover/Autodiscover.xml"],"events":39,"unique_ips":11,"actors":[{"ip":"32.193.171.199","events":8,"country_code":"US","country":"United States","org":"Amazon.com, Inc.","rdns":"scan.strongwind.dev","scanner_tag":null},{"ip":"179.43.186.241","events":7,"country_code":"CH","country":"Switzerland","org":"Private Layer INC","rdns":"hostedby.privatelayer.com","scanner_tag":null},{"ip":"74.249.104.193","events":6,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"20.17.96.244","events":4,"country_code":"MY","country":"Malaysia","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"100.48.18.224","events":4,"country_code":"US","country":"United States","org":"Amazon.com, Inc.","rdns":"ec2-100-48-18-224.compute-1.amazonaws.com","scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"}},{"ip":"179.43.163.26","events":3,"country_code":"CH","country":"Switzerland","org":"Private Layer INC","rdns":"hosted-by.privatelayer.com","scanner_tag":null},{"ip":"79.124.40.174","events":3,"country_code":"BG","country":"Bulgaria","org":"Tamatiya EOOD","rdns":"ip-40-174.4vendeta.com","scanner_tag":null},{"ip":"20.51.193.86","events":1,"country_code":"US","country":"United States","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"20.251.66.63","events":1,"country_code":"NO","country":"Norway","org":"Microsoft Corporation","rdns":"","scanner_tag":null},{"ip":"101.36.125.58","events":1,"country_code":"HK","country":"Hong Kong","org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","rdns":"","scanner_tag":null},{"ip":"185.177.72.23","events":1,"country_code":"FR","country":"France","org":"Bucklog SARL","rdns":"","scanner_tag":null}],"top_asns":[{"asn":14618,"org":"Amazon.com, Inc.","events":12,"ips":2},{"asn":8075,"org":"Microsoft Corporation","events":12,"ips":4},{"asn":51852,"org":"Private Layer INC","events":10,"ips":2},{"asn":50360,"org":"Tamatiya EOOD","events":3,"ips":1},{"asn":211590,"org":"Bucklog SARL","events":1,"ips":1},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":1,"ips":1}],"fingerprints":{"ja4h":["ge11nn0500_2223cffcb26c","po11nn0700_e1eadaf42879","ge11nn14en_068ebe3632ec","po11nn0500_b4ba55311b46","ge11nn0400_91d9e55fb80a","ge11nn0400_9c3956fad5da"],"ja4":["t13i4310h1_c7886603b240_7379471da272","t13i130900_f57a46bbacb6_e7c285222651","t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i100800_61a7ad8aa9b6_d268365384ff"]},"sample_paths":["/Autodiscover/Autodiscover.xml","/autodiscover/autodiscover.xml/","/autodiscover/autodiscover.xml"],"timeline":[{"day":"2026-04-28","events":1,"ips":1},{"day":"2026-05-04","events":2,"ips":1},{"day":"2026-05-05","events":1,"ips":1},{"day":"2026-05-11","events":2,"ips":1},{"day":"2026-05-12","events":7,"ips":2},{"day":"2026-05-14","events":2,"ips":1},{"day":"2026-05-15","events":1,"ips":1},{"day":"2026-05-17","events":2,"ips":1},{"day":"2026-06-11","events":1,"ips":1},{"day":"2026-06-15","events":2,"ips":1},{"day":"2026-06-21","events":1,"ips":1},{"day":"2026-07-02","events":1,"ips":1},{"day":"2026-07-04","events":1,"ips":1},{"day":"2026-07-05","events":1,"ips":1},{"day":"2026-07-06","events":1,"ips":1},{"day":"2026-07-15","events":1,"ips":1},{"day":"2026-07-25","events":4,"ips":1},{"day":"2026-07-27","events":8,"ips":1}],"window_hours":2160}