[
 {
  "value": "5.180.41.35",
  "type": "ipv4",
  "first_seen": "2026-06-17",
  "last_seen": "2026-07-25",
  "status": "expired",
  "confidence": "corroborated",
  "n_sources": 2,
  "stories": [
   "clop-created-custom-web-shell-for-windchill-data-theft-attacks",
   "clop-group-claims-massive-data-heist-from-shell-philips-ge-via-p"
  ],
  "sources": [
   "https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html",
   "https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability"
  ],
  "reason": "Clop C2 IP in PTC Windchill webshell attacks"
 },
 {
  "value": "79.141.160.78",
  "type": "ipv4",
  "first_seen": "2026-07-22",
  "last_seen": "2026-07-22",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "clop-created-custom-web-shell-for-windchill-data-theft-attacks"
  ],
  "sources": [
   "https://ransom-isac.org/blog/clop-windchill-flexplm-exploitation/"
  ],
  "reason": "Observed C2 IP in Clop PTC compromise"
 },
 {
  "value": "321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf",
  "type": "sha256",
  "first_seen": "2026-08-18",
  "last_seen": "2026-08-18",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "clop-created-custom-web-shell-for-windchill-data-theft-attacks"
  ],
  "sources": [
   "https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign"
  ],
  "reason": "Clop Windchill JSP implant hash"
 }
]