[
 {
  "value": "103.102.31.18",
  "type": "ipv4",
  "first_seen": "2026-09-05",
  "last_seen": "2026-09-22",
  "status": "active",
  "confidence": "corroborated",
  "n_sources": 2,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo",
   "cisa-kev-update-five-actively-exploited-artifactory-screenconnec"
  ],
  "sources": [
   "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/",
   "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"
  ],
  "reason": "Attacker IP exploiting MikroTik RouterOS login argument injection"
 },
 {
  "value": "82.192.72.4",
  "type": "ipv4",
  "first_seen": "2026-09-05",
  "last_seen": "2026-09-22",
  "status": "active",
  "confidence": "corroborated",
  "n_sources": 2,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo",
   "cisa-kev-update-five-actively-exploited-artifactory-screenconnec"
  ],
  "sources": [
   "https://cert.pl/en/posts/2026/09/mikrotrick-technical-analysis/",
   "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"
  ],
  "reason": "Attacker IP exploiting MikroTik RouterOS login argument injection"
 },
 {
  "value": "eeongous.com",
  "type": "domain",
  "first_seen": "2026-09-04",
  "last_seen": "2026-09-04",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo"
  ],
  "sources": [
   "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"
  ],
  "reason": "RouterOS backdoor campaign infrastructure"
 },
 {
  "value": "leappoach.info",
  "type": "domain",
  "first_seen": "2026-09-04",
  "last_seen": "2026-09-04",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo"
  ],
  "sources": [
   "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"
  ],
  "reason": "RouterOS backdoor campaign infrastructure"
 },
 {
  "value": "mythtime.xyz",
  "type": "domain",
  "first_seen": "2026-09-04",
  "last_seen": "2026-09-04",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "trois-cve-sur-mikrotik-routeros-des-quipements-massivement-d-plo"
  ],
  "sources": [
   "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/"
  ],
  "reason": "RouterOS backdoor campaign infrastructure"
 }
]