[
 {
  "value": "135.136.63.63",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "139.28.49.138",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "146.70.169.246",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "152.53.173.29",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "152.53.173.30",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "176.65.149.52",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "193.24.211.91",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "193.32.126.168",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "212.132.98.170",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "217.154.53.116",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "217.154.53.187",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "31.177.110.136",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "37.32.73.156",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "45.90.4.121",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "45.90.4.128",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "51.91.190.241",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "51.91.190.242",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "Gsocket C2 IP in TargetZimbra ransomware campaign"
 },
 {
  "value": "64.62.156.162",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "64.62.156.222",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "64.62.156.94",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "88.214.21.183",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "89.116.171.182",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "89.117.94.35",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "C2 IP in TargetZimbra ransomware campaign exploiting CVE-2026-73570"
 },
 {
  "value": "gs.thc.org",
  "type": "domain",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "critical-zimbra-rce-flaw-now-actively-exploited-in-attacks"
  ],
  "sources": [
   "https://habr.com/ru/companies/pt/articles/1082654/"
  ],
  "reason": "GSocket C2 indicators in Zimbra ransomware attack (CVE-2026-73570)"
 }
]