IOCs for CVE-2019-19781
citrixhoneypotnslookup.txt contains whois results for the IP addresses listed in ips.txt.
these were the addresses that showed up most frequently in the logs of the honeypot discussed here: https://www.digitalshadows.com/blog-and-research/cve-2019-19781-analyzing-the-exploit/