{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/zimbra-cve-2026-73570-mail-server-incident-review/",
    "fang": "live",
    "exported_at": "2026-09-30T15:03:54Z",
    "total": 29,
    "categories": 6
  },
  "iocs": {
    "IPv4:Port": [
      "117.107.25.243:7071",
      "192.255.193.111:9004",
      "193.42.40.135:443",
      "3.209.137.175:443",
      "45.32.30.235:8080",
      "45.32.30.235:8081"
    ],
    "Domains": [
      "aka.ms",
      "bypass.eu.org",
      "dnslog.pp.ua",
      "mexico-cashpay-test.s3.dualstack.mx-central-1.amazonaws.com",
      "oast.fun",
      "oast.online",
      "psk1zim.abrdns.com",
      "requestrepo.com",
      "tls.psk1zim.abrdns.com",
      "transzimbra.linkpc.net",
      "wslogzimbra.linkpc.net",
      "wsweb03.blob.core.windows.net"
    ],
    "URLs": [
      "https://aka.ms/downloadazcopy-v10-linux"
    ],
    "sha256": [
      "22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69",
      "518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b6",
      "65a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec435",
      "6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244",
      "aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d",
      "b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159",
      "bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf",
      "dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a"
    ],
    "CVEs": [
      "CVE-2026-73570"
    ],
    "Ethereum Addresses": [
      "0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586"
    ]
  }
}