Community list of bad Ips from Exchange Exploits
For more info please see: https://www.pwndefend.com/2021/03/07/checking-for-hafnium-or-other-groups-impact-from-exchange-abuse/
I've updated this to have a confirmed HAFNIUM only file. The larger list is related to proxylogon abuse or webshell abuse indicators.