[
 {
  "value": "85.11.187.8",
  "type": "ipv4",
  "first_seen": "2026-06-20",
  "last_seen": "2026-06-20",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "alert-fortibleed-remains-active-campaign-can-lock-out-users-or-l"
  ],
  "sources": [
   "https://unit42.paloaltonetworks.com/large-scale-credential-attacks/"
  ],
  "reason": "Malicious infrastructure IP linked to FortiBleed credential-harvesting campaign"
 }
]