[
 {
  "value": "103.102.31.18",
  "type": "ipv4",
  "first_seen": "2026-09-05",
  "last_seen": "2026-09-22",
  "status": "active",
  "confidence": "corroborated",
  "n_sources": 2,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo",
   "cisa-kev-update-five-actively-exploited-artifactory-screenconnec"
  ],
  "sources": [
   "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/",
   "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"
  ],
  "reason": "Attacker IP exploiting MikroTik RouterOS login argument injection"
 },
 {
  "value": "82.192.72.4",
  "type": "ipv4",
  "first_seen": "2026-09-05",
  "last_seen": "2026-09-22",
  "status": "active",
  "confidence": "corroborated",
  "n_sources": 2,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo",
   "cisa-kev-update-five-actively-exploited-artifactory-screenconnec"
  ],
  "sources": [
   "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/",
   "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"
  ],
  "reason": "Attacker IP exploiting MikroTik RouterOS login argument injection"
 }
]