[
 {
  "value": "104.207.144.154",
  "type": "ipv4",
  "first_seen": "2026-05-30",
  "last_seen": "2026-05-30",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pan-os-cve-2026-0257-cisa-kev-globalprotect-authentication-bypas"
  ],
  "sources": [
   "https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257"
  ],
  "reason": "Attacker IP in PAN-OS exploitation wave (Vultr hosting, GP-CLIENT)"
 },
 {
  "value": "146.19.216.119",
  "type": "ipv4",
  "first_seen": "2026-05-30",
  "last_seen": "2026-05-30",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "pan-os-cve-2026-0257-cisa-kev-globalprotect-authentication-bypas"
  ],
  "sources": [
   "https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257"
  ],
  "reason": "Attacker IP in PAN-OS exploitation wave (Dromatics Systems)"
 }
]