[
 {
  "value": "160.119.76.250",
  "type": "ipv4",
  "first_seen": "2026-04-13",
  "last_seen": "2026-04-13",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers"
  ],
  "sources": [
   "https://isc.sans.edu/forums/diary/Scans+for+EncystPHP+Webshell/32892/"
  ],
  "reason": "Probe IP in FreePBX Jomangy webshell campaign"
 },
 {
  "value": "187.108.1.130",
  "type": "ipv4",
  "first_seen": "2026-01-28",
  "last_seen": "2026-01-28",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers"
  ],
  "sources": [
   "https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp"
  ],
  "reason": "Dropper infrastructure in FreePBX Jomangy campaign"
 },
 {
  "value": "45.234.176.202",
  "type": "ipv4",
  "first_seen": "2026-01-28",
  "last_seen": "2026-01-28",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers"
  ],
  "sources": [
   "https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp"
  ],
  "reason": "Dropper infrastructure in FreePBX Jomangy campaign"
 },
 {
  "value": "45.95.147.178",
  "type": "ipv4",
  "first_seen": "2026-04-13",
  "last_seen": "2026-04-13",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers"
  ],
  "sources": [
   "https://isc.sans.edu/forums/diary/Scans+for+EncystPHP+Webshell/32892/"
  ],
  "reason": "Attacker C2 IP in FreePBX post-exploitation script (cron persistence + payload delivery via base64/ROT13 obfuscated shell)"
 }
]