[
 {
  "value": "138.2.102.66",
  "type": "ipv4",
  "first_seen": "2026-09-16",
  "last_seen": "2026-09-16",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Pakistani attacker IP chaining CVE-2017-9841 and CVE-2021-41773 in active exploitation"
 },
 {
  "value": "160.250.132.238",
  "type": "ipv4",
  "first_seen": "2026-09-14",
  "last_seen": "2026-09-14",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Attacker IP chaining CVE-2017-9844 path traversal in Singapore-linked campaign"
 },
 {
  "value": "165.99.207.153",
  "type": "ipv4",
  "first_seen": "2026-09-15",
  "last_seen": "2026-09-15",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Pakistani attacker IP chaining CVE-2017-9841 and CVE-2021-41773 in active exploitation"
 },
 {
  "value": "194.233.84.90",
  "type": "ipv4",
  "first_seen": "2026-09-20",
  "last_seen": "2026-09-20",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Pakistani attacker IP chaining CVE-2017-9841 and CVE-2021-41773 in active exploitation campaign"
 },
 {
  "value": "213.209.159.154",
  "type": "ipv4",
  "first_seen": "2026-09-12",
  "last_seen": "2026-09-12",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Attacker IP chaining CVE-2017-9841, CVE-2021-41773, CVE-2021-42013 (Path Traversal Tourist)"
 },
 {
  "value": "45.78.224.85",
  "type": "ipv4",
  "first_seen": "2026-10-01",
  "last_seen": "2026-10-01",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Scanner IP chaining CVE-2017-9841 (PHPUnit) and CVE-2021-41773 (Apache path traversal) in active exploitation"
 },
 {
  "value": "47.236.173.77",
  "type": "ipv4",
  "first_seen": "2026-09-11",
  "last_seen": "2026-09-11",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Attacker IP chaining CVE-2017-9844 path traversal in Singapore-linked campaign"
 },
 {
  "value": "49.0.202.115",
  "type": "ipv4",
  "first_seen": "2026-10-04",
  "last_seen": "2026-10-04",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Attacker scanner IP (CVE-2021-41773 path traversal attempts, AS136907)"
 },
 {
  "value": "89.126.211.166",
  "type": "ipv4",
  "first_seen": "2026-10-03",
  "last_seen": "2026-10-03",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pakistani-ip-chains-cve-2017-9841-and-cve-2021-41773-in-active-e"
  ],
  "sources": [
   "https://cyberveille.ch/map/"
  ],
  "reason": "Scanner IP chaining CVE-2017-9841 and CVE-2021-41773"
 }
]